Which SIEM platforms have a T1078.003 detection rule?

df00tech provides T1078.003 (Local Accounts) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Local Accounts (T1078.003)?

Detecting Local Accounts requires the following data sources: Logon: Logon, User Account: User Account Creation, User Account: User Account Modification, Windows Security Event Log.

What severity and confidence is the T1078.003 detection?

The T1078.003 detection is rated high severity with medium confidence.

What are common false positives for T1078.003?

Common false positives for T1078.003 include: IT helpdesk creating local accounts for break-glass or emergency access scenarios (expected during documented maintenance windows); Software installation procedures that create local service accounts (e.g., SQL Server, antivirus agents, monitoring tools installing their own local accounts); Remote management tools (e.g., LAPS, PDQ Deploy, SCCM) authenticating to endpoints using the local administrator account for legitimate patching or management tasks.

T1078.003 Google Chronicle · YARA-L

Detect Local Accounts in Google Chronicle

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Adversaries may target dormant local accounts, brute-force local admin credentials, create new local accounts, or reuse harvested credentials across multiple systems. This technique is commonly observed in ransomware operations, APT lateral movement, and post-exploitation frameworks such as Cobalt Strike.

MITRE ATT&CK

Tactic: Defense Evasion Persistence Privilege Escalation Initial Access
Technique: T1078 Valid Accounts
Sub-technique: T1078.003 Local Accounts
Canonical reference: https://attack.mitre.org/techniques/T1078/003/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule t1078_003_local_account_abuse {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects suspicious local account activity including creation, reactivation, privilege escalation, network logons, explicit credential use, and brute force patterns consistent with T1078.003."
    mitre_attack_tactic = "Initial Access, Persistence, Privilege Escalation, Defense Evasion"
    mitre_attack_technique = "T1078.003"
    severity = "HIGH"
    priority = "HIGH"
    false_positives = "IT provisioning scripts, config management tools, help desk remote access"

  events:
    (
      $e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
      and $e.metadata.event_type in (
        "USER_CREATION",
        "USER_CHANGE_PERMISSIONS",
        "USER_LOGIN",
        "USER_LOGIN_FAIL",
        "USER_UNCATEGORIZED"
      )
      and (
        $e.target.user.windows_sid != /^S-1-5-21-\d+-\d+-\d+-500$/ // Not built-in Administrator by SID alone
        or $e.metadata.product_event_type in ("4720", "4722", "4732", "4648")
      )
      // Local account indicator: domain matches hostname or is empty/dot
      and (
        $e.target.user.user_display_name != ""
        and (
          $e.target.administrative_domain = "."
          or $e.target.administrative_domain = ""
          or $e.target.administrative_domain = $e.principal.hostname
        )
      )
      // Exclude built-in noisy accounts
      and not $e.target.user.user_display_name in (
        "ANONYMOUS LOGON", "LOCAL SERVICE", "NETWORK SERVICE",
        "SYSTEM", "DWM-1", "DWM-2", "DWM-3", "UMFD-0", "UMFD-1"
      )
      // For logon events (4624), require network or remote interactive logon type and non-loopback source
      and (
        $e.metadata.product_event_type != "4624"
        or (
          $e.extensions.auth.auth_details in ("3", "10")
          and not $e.principal.ip in ("127.0.0.1", "::1")
        )
      )
    )

  match:
    $e.principal.hostname over 1h

  outcome:
    $hostname = $e.principal.hostname
    $target_user = $e.target.user.user_display_name
    $event_code = $e.metadata.product_event_type
    $source_ip = $e.principal.ip
    $risk_score = if(
      $e.metadata.product_event_type = "4732", 4,
      if($e.metadata.product_event_type = "4720", 3,
        if($e.metadata.product_event_type = "4648", 3,
          if($e.metadata.product_event_type = "4722", 2,
            if($e.metadata.product_event_type = "4624", 2, 1)
          )
        )
      )
    )

  condition:
    $e
}

high severity medium confidence

Chronicle YARA-L 2.0 rule detecting suspicious local account abuse aligned to MITRE ATT&CK T1078.003. Matches Windows Security Auditing events for account creation, enabling, admin group membership changes, network logons, explicit credential use, and failed logons. Uses UDM target.administrative_domain field to identify local versus domain accounts by matching to the principal hostname or checking for dot/empty domain notation.

Data Sources

Windows Security Event Log forwarded to Google Chronicle via Chronicle forwarder or BindPlane

Required Tables

UDM events with metadata.product_name = Microsoft-Windows-Security-Auditing

False Positives & Tuning

Privileged Access Workstation (PAW) configurations where administrators routinely use local accounts for sensitive operations, generating frequent 4624 Type 10 events
Automated deployment pipelines creating local service accounts on newly imaged systems as part of a golden image build process
Remote monitoring and management (RMM) agents such as ConnectWise or Kaseya that authenticate using local admin credentials across endpoints

Download portable Sigma rule (.yml)

Other platforms for T1078.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Create Backdoor Local Admin Account
Expected signal: Security EventID 4720: New local account 'argus_test_backdoor' created (TargetDomainName will match ComputerName). Security EventID 4732: Account added to Administrators group (TargetUserName=Administrators). Security EventID 4722: Account enabled. Process creation events for net.exe and net1.exe (Sysmon EventID 1 or Security EventID 4688).
Test 2Brute Force Local Administrator Account
Expected signal: 15x Security EventID 4625 (logon failure) with TargetUserName=Administrator, LogonType=3, IpAddress=127.0.0.1. Failure reason 0xC000006D (wrong password) or 0xC000006A. SubStatus 0xC0000064 or 0xC000006A. Events will appear in rapid succession within a 1-minute window.
Test 3Pass-the-Hash Style Lateral Movement Using Local Account Credentials
Expected signal: Security EventID 4648 (explicit credentials used) on the initiating host with TargetUserName=Administrator, TargetDomainName=<COMPUTERNAME>. Security EventID 4624 (LogonType=3) on the target with TargetUserName=Administrator, TargetDomainName=<COMPUTERNAME>, IpAddress of initiating host. Sysmon EventID 3: network connection to destination port 445.
Test 4Enable and Use Disabled Built-in Administrator Account via Registry
Expected signal: Security EventID 4722 (local account enabled) with TargetUserName=Administrator. Security EventID 4723 or 4724 (password change/reset) for the Administrator account. Process creation events for net.exe (Sysmon EventID 1). If the account is then used for logon, EventID 4624 with TargetUserName=Administrator and LogonType matching the access method.
Test 5Linux Local Account Abuse — Create Privileged User and Switch Context
Expected signal: Syslog/auth.log: useradd command execution, new user creation entry. /var/log/auth.log or /var/log/secure: PAM authentication events for su session. auditd (if configured): syscall audit records for useradd (execve), usermod (execve), write to /etc/passwd and /etc/shadow. Sysmon for Linux (if deployed): process creation events for useradd, usermod, chpasswd, su.

Last updated: 2026-04-18 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1078.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Local Accounts in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1078.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1078.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox