Create Account detection rulesT1136

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

windows · process_creation

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.

windows

Find local accounts being created or modified as well as remote authentication configurations

cisco

Sysmon registry detection of a local hidden user account.

windows · registry_event

Detects creation of local users via the net.exe command with the name of "DarkGate"

windows · process_creation

Detects the creation of a local hidden user account which should not happen for event ID 4720.

windows

Detects creation of local users via the net.exe command with the option "never expire"

windows · process_creation

Detects the addition of a new user to a privileged group such as "root" or "sudo"

linux

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

windows · file_event

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

windows

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

windows · process_creation

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

linux

Detects user account creation on ESXi system via esxcli

linux · process_creation

Detects the creation of an administrator account on a Fortinet FortiGate Firewall.

fortigate

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

fortigate

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

windows · ps_script

Detects the addition of a new Federated Domain.

m365

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

windows · ps_script

Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

windows · process_creation

Identifies the creation of local users via the net.exe command.

windows · process_creation

Detects creation of a local user via PowerShell

windows · ps_script

Detects when an ElastiCache security group has been created.

aws

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

macos · process_creation

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

windows

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

kubernetes · application

Detects when a new member is added or invited to a github organization.

github