AN1235
Analytic 1235
Windows
Adversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).
WinEventLog:Security
EventCode=4720
WinEventLog:Sysmon
EventCode=1
[ParentProcessName]
Attackers may use cmd.exe, wscript.exe, or renamed binaries to evade detection
[TimeWindow]
Define time threshold between process start and user creation event (e.g., 5s–2m)
[UserContext]
Correlate if process runs under SYSTEM, Administrator, or untrusted account
AN1236
Analytic 1236
Linux
Local user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.
auditd:SYSCALL
useradd or adduser executed
auditd:SYSCALL
write operation on /etc/passwd or /etc/shadow
[BinaryPath]
Account creation may be scripted via shell scripts, cron jobs, or remote shells
[ExecutionSource]
Flag if commands are issued from remote sessions (e.g., sshd)
AN1237
Analytic 1237
macOS
Account creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.
macos:unifiedlog
dscl -create
macos:unifiedlog
modification to /var/db/dslocal/nodes/Default/users/
[UsernamePattern]
Accounts like 'svc*', 'backup*' may blend into legit naming patterns
[SessionOrigin]
Identify if dscl was run locally, via ARD, or Terminal.app
AN1238
Analytic 1238
ESXi
Account created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.
esxi:vmkernel
esxcli system account add
[CommandOrigin]
Console sessions vs SSH vs vSphere CLI session may affect alert fidelity
AN1239
Analytic 1239
Containers
Account created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).
ebpf:syscalls
useradd or /etc/passwd modified inside container
[ContainerContext]
Distinguish between ephemeral containers and long-lived service containers
[NamespaceScope]
Determine if account was added inside host, user, or PID namespace
AN1240
Analytic 1240
Network Devices
Account created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.
networkdevice:syslog
username <user> privilege <level>
[PrivilegeLevel]
Some devices allow unprivileged user creation—adjust based on role risk
[RemoteSessionFlag]
Creation via Telnet, SSH, or serial console affects detection priority