AN1604
Analytic 1604
Windows
Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.
WinEventLog:Security
EventCode=4720
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Correlation between Event ID 4720 and creating process may vary by environment and automation delays
[ParentProcessName]
Tools like net.exe or powershell.exe can be normal or malicious depending on user context
[UserContext]
System vs. administrator vs. low-privilege user context changes alert criticality
AN1605
Analytic 1605
Linux
Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.
auditd:SYSCALL
useradd or adduser executed
auditd:SYSCALL
chmod/chown to /etc/passwd or /etc/shadow
[BinaryPath]
Custom scripts or renamed binaries may evade simple path-based detection
[ExecutionTime]
Account creation outside maintenance windows may indicate compromise
AN1606
Analytic 1606
macOS
Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.
macos:unifiedlog
dscl . -create
macos:unifiedlog
modification to /var/db/dslocal/nodes/Default/users/
[UsernamePattern]
Attackers may use service-like names to hide malicious accounts
[ExecutionSource]
Accounts created via Terminal vs GUI vs remote session can affect confidence
AN1607
Analytic 1607
Identity Provider
Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.
azure:audit
Add user
[AdminThreshold]
Trigger alert only when account is assigned privileged roles
[AutomationExemptions]
Exclude accounts from known automation processes or provisioning pipelines
AN1608
Analytic 1608
IaaS
Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.
AWS:CloudTrail
CreateUser
AWS:CloudTrail
AttachUserPolicy
[Region]
Alert on account creation outside expected geographies
[ServiceScope]
Filter on creation of users scoped to sensitive services