Account created with a name mimicking a trusted or default account

1title: Account created with a name mimicking a trusted or default account2id: 6e8509b2-8e45-4fb5-a4fc-e78834dcf6853status: experimental4description: |5  AN1077's real ask is a Levenshtein or visual-distance comparison against6  MonitoredAccountList — lib/sigma has no string-distance function and no7  lookup-table construct, so neither knob can be computed here. What survives8  is literal-string matching against the example names MITRE itself supplies9  in two places: the technique's own prose, which names "admin", "help" and10  "root" as the generic, trustworthy names adversaries reach for, and the11  analytic's own description, which names three concrete near-miss patterns12  verbatim — "admin1", "adm1n" and "backup_help". "backup" and "service" are13  added to the same contains list because the technique text separately calls14  out masquerading as accounts "associated with legitimate software, data15  backups, or container cluster management" — still MITRE's framing, not this16  pipeline's invention, just generalised from prose to a substring. This is a17  precision trade the rule accepts on purpose: `TargetUserName|contains:18  'admin'` also matches any ordinary account whose name happens to contain19  that substring, and MITRE's own MonitoredAccountList knob is the intended20  fix — a real deployment must supply the set of legitimate accounts this21  pipeline has no way to know, so the false-positive list below is long and22  the level is set accordingly. TimeWindow, which would raise severity only23  when creation follows a discovery or deletion event, needs a cross-event24  join this corpus cannot express, so every match here carries the same25  weight regardless of what preceded it.26  The Linux leg, AN1078, is not attempted in this file: lib/sigma renders one27  logsource per rule, and 4720 is the cleaner single-event signal of the two.28  For the record, its two auditd legs are real but weaker — the account name29  lands in EXECVE's `a1` (or later, depending on options placed before it)30  rather than at a fixed position, the same positional uncertainty already31  accepted for systemctl and hping in this corpus's T1569.003 and T1499.00132  rules — and its third leg, {product: linux, service: osquery} listing33  /etc/passwd, has no standardised Sigma field vocabulary anywhere in this34  corpus.35  Prerequisite: 4720 is written by the Audit User Account Management36  subcategory (Success), on by default and in both the Microsoft and CIS37  baselines, but a host whose audit policy was rewritten can still be blind —38  confirm with auditpol rather than assuming.39  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0383, not hand-written and not tested by its author. Any lab result is on this rule's own page.40references:41  - https://attack.mitre.org/techniques/T1036/01042  - https://attack.mitre.org/detectionstrategies/DET038343author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)44date: 2026-08-1845tags:46  - attack.defense-evasion47  - attack.t1036.01048logsource:49  product: windows50  service: security51detection:52  selection_account_created:53    EventID: 472054  selection_trusted_name_pattern:55    TargetUserName|contains:56      - 'admin'57      - 'help'58      - 'root'59      - 'backup'60      - 'service'61      - 'adm1n'62      - 'backup_help'63  condition: selection_account_created and selection_trusted_name_pattern64falsepositives:65  - "Routine IT and helpdesk account provisioning using role-based naming that happens to contain one of these substrings — accounts such as helpdesk_l2, it_admin_jdoe, svc_backup or backup_svc_sql created by ordinary onboarding, not by an adversary. On an estate with such a naming convention this is the loudest source by a wide margin and is why the level here is low rather than high."66  - "Software and appliance installers creating a dedicated local service account as part of setup — backup agents, monitoring agents, and database engines routinely name their own service account with 'service', 'admin' or 'backup' in it, on every host the package is deployed to."67  - "Documented break-glass or emergency-access accounts deliberately named to resemble a built-in, such as admin_breakglass or local_admin_dr, created once and then left dormant until an actual outage."68  - "Training, lab and onboarding environments where a demo or coursework account named admin, helpdesk or similar is created intentionally and repeatedly as part of the exercise."69level: low