Local account created from a command line

1title: Local account created from a command line2id: 54b94366-699f-479e-81a4-3c28e96d791d3status: experimental4description: |5  AN1235 describes an adversary creating a local user with built-in tooling and6  names `net user /add` and PowerShell as the examples; this rule is the7  process-creation half of that analytic, written so that what matches is local8  rather than domain account creation. The net leg wants `net.exe` or `net1.exe`9  as the image — either can be the logged one, because net.exe re-executes10  itself as net1.exe with the same arguments, which also means a `cmd /c net11  user ... /add` or a PowerShell wrapper still produces a matching child process12  — together with a ` user ` subcommand and an `/add` or `-add` switch. The13  absent `/domain` switch is the discriminator against the sibling T1136.002,14  whose rule requires it, so a ` /do` or ` -do` substring removes the event15  here. The second leg is the `New-LocalUser` cmdlet typed inline. The16  subcommand and switch spellings are authored here, not taken from MITRE — the17  analytic supplies the behaviour, not the strings.18  Four limits are structural. Account creation through the API rather than a19  shell — `NetUserAdd` from a compiled implant, the ADSI `WinNT://` provider's20  `Create("User")`, or the `Win32_UserAccount` WMI class — writes no matching21  command line, and `New-LocalUser` called from inside a .ps1, a module or a22  here-string never reaches `CommandLine` at all. The domain exclusion is a23  substring test for the switch as typed and as abbreviated, so a wrapper that24  passes `/domain` through a variable falls into this rule as a false match on25  the sibling. And MITRE's own knobs on this analytic are `ParentProcessName`,26  `TimeWindow` and `UserContext` — was the shell spawned by cmd.exe, wscript.exe27  or a renamed binary, did the 4720 account-creation record follow within28  seconds to minutes, was the caller SYSTEM or an untrusted account — which are29  a cross-event join and a per-identity baseline that Sigma models none of, so30  the rule is left matching the single command-line event and the 4720 arm of31  AN1235 is not attempted. Expect overlap with the published T1087.001 rule,32  which selects the same net.exe ` user` shape as enumeration and will match33  every event this rule does. This rule is written in the Sysmon EventID 134  vocabulary (`Image`, `CommandLine`) that AN1235 names; an estate feeding35  Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and36  4688 needs both *Audit Process Creation* and the separate *Include command37  line in process creation events* policy before `CommandLine` exists at all —38  neither is on in a default install or in the Microsoft and CIS baselines.39  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0447, not hand-written and not tested by its author. Any lab result is on this rule's own page.40references:41  - https://attack.mitre.org/techniques/T1136/00142  - https://attack.mitre.org/detectionstrategies/DET044743author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)44date: 2026-08-1645tags:46  - attack.persistence47  - attack.t1136.00148logsource:49  category: process_creation50  product: windows51detection:52  selection_net_binary:53    Image|endswith:54      - '\net.exe'55      - '\net1.exe'56  selection_net_user_verb:57    CommandLine|contains: ' user '58  selection_net_add_switch:59    CommandLine|contains:60      - ' /add'61      - ' -add'62  filter_domain_scope:63    CommandLine|contains:64      - ' /do'65      - ' -do'66  selection_localuser_cmdlet:67    CommandLine|contains: 'New-LocalUser'68  condition: (selection_net_binary and selection_net_user_verb and selection_net_add_switch and not filter_domain_scope) or selection_localuser_cmdlet69falsepositives:70  - "Imaging, provisioning and build automation. MDT and Configuration Manager task sequences, Autopilot and Intune remediation scripts, and Packer, Vagrant and CI image builds create a local administrator, a lab account or a product service account with net user <name> <password> /add as a standard build step. This is the loudest match this rule has — one or more hits per machine build, estate-wide during a rollout — and it is why the level sits at medium rather than high; it is also the easiest to tune out, because the parent is a known task-sequence host process rather than an interactive shell."71  - "Application, database and backup product installers that provision a dedicated local service account during install, repair or upgrade, either directly or from a vendor post-install script, with no operator intent behind the event."72  - "Service desk and desktop support creating a temporary local account on a shared, kiosk, lab or standalone machine, or recreating one on a device that has lost its domain trust. The command is character-for-character the one an adversary would type and only the operator account separates them."73  - "Local break-glass and offline-access procedures, where a documented runbook has an administrator create an emergency local account before maintenance on a host that will be off the domain network."74  - "Migration and platform tooling that stages local accounts before a join or a rebuild, including domain-migration utilities and virtual desktop image preparation, which run in bursts against many hosts inside one maintenance window."75level: medium