Detect Local Account in CrowdStrike LogScale
Adversaries may create a local account to maintain persistent access to victim systems. Local accounts can be created using built-in OS commands such as net user /add (Windows), useradd or adduser (Linux), or dscl -create (macOS). Adversaries including Wizard Spider, APT5, Fox Kitten, TeamTNT, and FIN13 have used this technique to establish secondary access that survives credential rotation and does not require persistent remote access tools. Created accounts are often added to the local Administrators group to maximize their utility. Common naming patterns observed in the wild include service-like names (supportaccount, HelpAssistant) designed to blend with legitimate accounts.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1136 Create Account
- Sub-technique
- T1136.001 Local Account
- Canonical reference
- https://attack.mitre.org/techniques/T1136/001/
LogScale Detection Query
// Branch 1 & 2: Windows Security Events 4720 and 4732 via UserAccountControl or audit logs
#event_simpleName = "UserAccountCreated" OR #event_simpleName = "GroupMemberAdded"
| eval DetectionBranch = case(
#event_simpleName == "UserAccountCreated", "UserAccount_Created_4720",
#event_simpleName == "GroupMemberAdded" AND TargetGroupName IN ("Administrators", "Remote Desktop Users", "Remote Management Users", "Backup Operators"), "PrivGroup_Add_4732",
true, "Other"
)
| where DetectionBranch != "Other"
| table _timeutc, ComputerName, UserName, TargetUserName, TargetGroupName, SubjectUserName, DetectionBranch
OR
// Branch 3: Process-based detection via Falcon ProcessRollup2
#event_simpleName = "ProcessRollup2"
| where FileName in~ ("net.exe", "net1.exe")
| where CommandLine = /(?i).*\buser\b.*\/add.*/
| where ParentBaseFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| eval SuspiciousParent = 1
| eval DetectionBranch = "ProcessBased_NetUserAdd"
| table _timeutc, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, SuspiciousParent, DetectionBranch
// Unified view across all branches - combine results and sort
| groupBy([ComputerName, DetectionBranch], function=[
count(as=EventCount),
min(_timeutc, as=FirstSeen),
max(_timeutc, as=LastSeen)
])
| sort LastSeen descDetects local account creation via CrowdStrike Falcon telemetry using UserAccountCreated and GroupMemberAdded events for privileged group additions, and ProcessRollup2 events to identify net.exe/net1.exe executions with /add arguments spawned from suspicious parent processes.
Data Sources
Required Tables
False Positives & Tuning
- IT asset management workflows that automatically create local admin accounts for out-of-band management on servers without domain connectivity
- Application installers running as SYSTEM that create dedicated local service accounts (e.g., database engines, monitoring agents)
- Vulnerability scanners or compliance tools that create temporary local accounts during authenticated scanning and clean them up afterward
Other platforms for T1136.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Local User Account with Net User
Expected signal: Security Event ID 4720 in Windows Security log: TargetUserName=df00testuser, SubjectUserName=<current admin account>. Sysmon Event ID 1: Image=net.exe or net1.exe, CommandLine containing 'user df00testuser /add'. Security Event ID 4722 (account enabled) will follow immediately.
- Test 2Create Local Account and Add to Administrators Group
Expected signal: Security Event ID 4720: account df00admintest created. Security Event ID 4732: member df00admintest added to Administrators group. Sysmon Event ID 1: two sequential net.exe process creation events — one with 'user /add' and one with 'localgroup Administrators /add'. The two events will be within seconds of each other on the same host.
- Test 3Create Local Account via PowerShell New-LocalUser
Expected signal: Security Event ID 4720: TargetUserName=df00pstest, SubjectUserName=<current user>. Security Event ID 4732: member df00pstest added to Administrators group. Sysmon Event ID 1: powershell.exe process with CommandLine containing 'New-LocalUser' and 'Add-LocalGroupMember'. PowerShell ScriptBlock Log Event ID 4104 will capture the full cmdlet invocations with all parameters.
- Test 4Create Local Account on Linux with useradd
Expected signal: auditd SYSCALL records for execve of /usr/sbin/useradd with arguments '-m -s /bin/bash -G sudo df00linuxtest'. syslog or auth.log entry: 'new user: name=df00linuxtest, UID=<uid>, GID=<gid>, home=/home/df00linuxtest, shell=/bin/bash'. auditd USER_MGMT type record for account creation. /etc/passwd and /etc/shadow modification events if file auditing is enabled.
References (10)
- https://attack.mitre.org/techniques/T1136/001/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-entities
- https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day
- https://intezer.com/blog/research/hiddenwasp-malware-targeting-linux-systems/
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
- https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/
Unlock Pro Content
Get the full detection package for T1136.001 including response playbook, investigation guide, and atomic red team tests.