Local account created from a command line

Siemphony@siemphonymediumT1136.001verified in lab

AN1235 describes an adversary creating a local user with built-in tooling and names `net user /add` and PowerShell as the examples; this rule is the process-creation half of that analytic, written so that what matches is local rather than domain account creation. The net leg wants `net.exe` or `net1.exe` as the image — either can be the logged one, because net.exe re-executes itself as net1.exe with the same arguments, which also means a `cmd /c net user ... /add` or a PowerShell wrapper still produces a matching child process — together with a ` user ` subcommand and an `/add` or `-add` switch. The absent `/domain` switch is the discriminator against the sibling T1136.002, whose rule requires it, so a ` /do` or ` -do` substring removes the event here. The second leg is the `New-LocalUser` cmdlet typed inline. The subcommand and switch spellings are authored here, not taken from MITRE — the analytic supplies the behaviour, not the strings. Four limits are structural. Account creation through the API rather than a shell — `NetUserAdd` from a compiled implant, the ADSI `WinNT://` provider's `Create("User")`, or the `Win32_UserAccount` WMI class — writes no matching command line, and `New-LocalUser` called from inside a .ps1, a module or a here-string never reaches `CommandLine` at all. The domain exclusion is a substring test for the switch as typed and as abbreviated, so a wrapper that passes `/domain` through a variable falls into this rule as a false match on the sibling. And MITRE's own knobs on this analytic are `ParentProcessName`, `TimeWindow` and `UserContext` — was the shell spawned by cmd.exe, wscript.exe or a renamed binary, did the 4720 account-creation record follow within seconds to minutes, was the caller SYSTEM or an untrusted account — which are a cross-event join and a per-identity baseline that Sigma models none of, so the rule is left matching the single command-line event and the 4720 arm of AN1235 is not attempted. Expect overlap with the published T1087.001 rule, which selects the same net.exe ` user` shape as enumeration and will match every event this rule does. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN1235 names; an estate feeding Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0447, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " user ") and (ProcessCommandLine contains " /add" or ProcessCommandLine contains " -add")) and not ((ProcessCommandLine contains " /do" or ProcessCommandLine contains " -do"))) or ProcessCommandLine contains "New-LocalUser")

Splunk · SPL

Run this as a search.

index=* (((((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* user *") AND (CommandLine="* /add*" OR CommandLine="* -add*")) AND NOT ((CommandLine="* /do*" OR CommandLine="* -do*"))) OR CommandLine="*New-LocalUser*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* user *") AND (TO_LOWER(process.command_line) LIKE "* /add*" OR TO_LOWER(process.command_line) LIKE "* -add*")) AND NOT ((TO_LOWER(process.command_line) LIKE "* /do*" OR TO_LOWER(process.command_line) LIKE "* -do*"))) OR TO_LOWER(process.command_line) LIKE "*new-localuser*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) user </field>    <field name="CommandLine" type="pcre2">(?i)( /add| -add)</field>    <field name="CommandLine" negate="yes" type="pcre2">(?i)( /do| -do)</field>    <description>Local account created from a command line (1/2)</description>    <mitre>      <id>T1136.001</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)New-LocalUser</field>    <description>Local account created from a command line (2/2)</description>    <mitre>      <id>T1136.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 54b94366-699f-479e-81a4-3c28e96d791d

ATT&CKT1136.001

T1136.001Local Account

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

The command-line half of AN1235: a local account created with built-in tooling. It matches the typed form of net user <name> <password> /add and the New-LocalUser cmdlet, and what separates it from the sibling T1136.002 rule is the absence of /domain. Two consequences worth stating plainly. Creation through the API — NetUserAdd from compiled code, ADSI WinNT://Create("User"), the Win32_UserAccount WMI class — writes no command line, and neither does lusrmgr.msc or the Settings app. AN1235's other log source, Security 4720, covers all of those paths; it is absent because it is a different logsource needing its own rule, not because it is unusable. The brief's Linux arm (AN1236 — useradd/adduser and writes to /etc/shadow, auditd) and macOS arm (AN1237 — dscl -create, unifiedlog) are untouched.

02 · Telemetry you need

category: process_creation / product: windows, verbatim from AN1235 — Sysmon EventID 1, fields Image and CommandLine. An estate feeding Security 4688 needs NewProcessName mapped onto Image first, and 4688 needs both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine exists at all. Neither is on in a default install or in the Microsoft and CIS baselines, so silence from this rule usually means missing policy rather than a quiet estate.

03 · How the logic works

Two legs. The net leg ANDs three selections and subtracts a filter. selection_net_binary takes Image|endswith \net.exe or \net1.exe — both are needed, because net.exe re-executes itself as net1.exe with the same arguments and it is often the child that gets logged. selection_net_user_verb requires ' user ' spaced on both sides, so net localgroup and net use cannot collide. selection_net_add_switch takes ' /add' or ' -add'. filter_domain_scope then removes anything containing ' /do' or ' -do' — the abbreviation-tolerant form of /domain, and the whole discriminator against the sibling. The second leg is a bare CommandLine|contains: 'New-LocalUser'. The subcommand and switch spellings are the pipeline's own; MITRE supplies behaviour, not strings. Its knobs on this analytic are ParentProcessName, TimeWindow and UserContext. The first is implementable as a filter and is simply not implemented; the other two are a cross-event join and a per-identity baseline Sigma models neither of.

04 · Common false positives

Build automation leads — task sequences, Autopilot and Intune remediations, Packer and CI image builds all create a local account as a standard step, one or more hits per machine build and estate-wide during a rollout. The rule ships at medium and calls that tunable by parent process, but carries no filter doing it.
Two problems the listed false positives miss. The cmdlet leg has no Image gate, so Get-Help New-LocalUser, an allowlist or JEA check passing the cmdlet name as an argument, and a script path like C:\Build\New-LocalUser.ps1 all match with no account created. And a domain controller has no local SAM: net user backdoor P@ss /add typed there creates a domain account with no /domain on the command line, so this rule fires and files it as local while the sibling, which requires the switch, misses it. No field in a process-creation event names the host role. Expect overlap too: the published T1087.001 rule matches the same net.exe user shape as enumeration, so every hit here already raises a second alert.

05 · Detection maturity

tier_1: , and it sits there until it has been run against real logs — reasoning on paper is not verification and says nothing about volume.
tier_2: run read-only for a fortnight, rank hits by ParentImage and user, and turn the top of that list into the missing filter.
tier_3: correlate with 4720 inside MITRE's TimeWindow so an alert means an account was created, not that a string appeared.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Gate the cmdlet leg on Image|endswith \powershell.exe / \pwsh.exe and
Implement MITRE's ParentProcessName knob as the filter the false positives
Split hosts by role at deployment so DC matches read as domain creation.
Build the Security 4720 companion; it carries every GUI and API path this rule

Declared by the author

Imaging, provisioning and build automation. MDT and Configuration Manager task sequences, Autopilot and Intune remediation scripts, and Packer, Vagrant and CI image builds create a local administrator, a lab account or a product service account with net user <name> <password> /add as a standard build step. This is the loudest match this rule has — one or more hits per machine build, estate-wide during a rollout — and it is why the level sits at medium rather than high; it is also the easiest to tune out, because the parent is a known task-sequence host process rather than an interactive shell.
Application, database and backup product installers that provision a dedicated local service account during install, repair or upgrade, either directly or from a vendor post-install script, with no operator intent behind the event.
Service desk and desktop support creating a temporary local account on a shared, kiosk, lab or standalone machine, or recreating one on a device that has lost its domain trust. The command is character-for-character the one an adversary would type and only the operator account separates them.
Local break-glass and offline-access procedures, where a documented runbook has an administrator create an emergency local account before maintenance on a host that will be off the domain network.
Migration and platform tooling that stages local accounts before a join or a rebuild, including domain-migration utilities and virtual desktop image preparation, which run in bursts against many hosts inside one maintenance window.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Local account creation
passed
Siemphony IR · 3 Sept 2026
5 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1136.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/54b94366-699f-479e-81a4-3c28e96d791d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local account created from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it