Detect Local Account in Microsoft Sentinel
Adversaries may create a local account to maintain persistent access to victim systems. Local accounts can be created using built-in OS commands such as net user /add (Windows), useradd or adduser (Linux), or dscl -create (macOS). Adversaries including Wizard Spider, APT5, Fox Kitten, TeamTNT, and FIN13 have used this technique to establish secondary access that survives credential rotation and does not require persistent remote access tools. Created accounts are often added to the local Administrators group to maximize their utility. Common naming patterns observed in the wild include service-like names (supportaccount, HelpAssistant) designed to blend with legitimate accounts.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1136 Create Account
- Sub-technique
- T1136.001 Local Account
- Canonical reference
- https://attack.mitre.org/techniques/T1136/001/
KQL Detection Query
// Branch 1: Windows Security Event 4720 — A user account was created
let AccountCreationEvents = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4720
| extend CreatedAccount = TargetUserName
| extend CreatedBy = SubjectUserName
| extend CreatedByDomain = SubjectDomainName
| extend CreatedOnHost = Computer
| project TimeGenerated, EventID, CreatedAccount, CreatedBy, CreatedByDomain, CreatedOnHost, Activity;
// Branch 2: Account added to local Administrators or privileged group (Event 4732) within 10 minutes of creation
let GroupAddEvents = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4732
| where TargetUserName in~ ("Administrators", "Remote Desktop Users", "Remote Management Users", "Backup Operators")
| extend AddedAccount = MemberName
| extend AddedToGroup = TargetUserName
| extend AddedBy = SubjectUserName
| project TimeGenerated, EventID, AddedAccount, AddedToGroup, AddedBy, Computer;
// Branch 3: Process-based detection — net user /add via command line
let NetUserAddEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "net.exe" or FileName =~ "net1.exe")
| where ProcessCommandLine has_any ("user ", "/add")
| where ProcessCommandLine has "/add"
| extend SuspiciousParent = InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SuspiciousParent;
// Combine and surface all results
union
(AccountCreationEvents | extend DetectionBranch = "SecurityEvent_4720"),
(GroupAddEvents | extend DetectionBranch = "SecurityEvent_4732_GroupAdd"),
(NetUserAddEvents | extend DetectionBranch = "DeviceProcessEvents_NetUserAdd")
| sort by TimeGenerated descDetects local account creation across three detection branches: (1) Windows Security Event ID 4720 (A user account was created) for direct OS-level telemetry on account creation; (2) Security Event ID 4732 (A member was added to a security-enabled local group) targeting Administrators and other privileged groups to catch accounts immediately elevated after creation; (3) DeviceProcessEvents for net.exe/net1.exe invocations with the /add flag, including parent process context to identify suspicious callers such as PowerShell, WScript, or other LOLBins. Combining all three branches maximizes coverage across different logging configurations.
Data Sources
Required Tables
False Positives & Tuning
- IT helpdesk or system administrators creating local service accounts for new application deployments or onboarding workflows
- Software installers (e.g., SQL Server, IIS, application suites) that create dedicated local service accounts during setup
- Configuration management tooling (Ansible, Chef, Puppet, DSC) that enforces a local account policy and creates or recreates accounts as part of a run
- Domain join workflows that briefly create local accounts before applying domain policy
- Automated provisioning systems creating local break-glass administrator accounts per a documented runbook
Other platforms for T1136.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Local User Account with Net User
Expected signal: Security Event ID 4720 in Windows Security log: TargetUserName=df00testuser, SubjectUserName=<current admin account>. Sysmon Event ID 1: Image=net.exe or net1.exe, CommandLine containing 'user df00testuser /add'. Security Event ID 4722 (account enabled) will follow immediately.
- Test 2Create Local Account and Add to Administrators Group
Expected signal: Security Event ID 4720: account df00admintest created. Security Event ID 4732: member df00admintest added to Administrators group. Sysmon Event ID 1: two sequential net.exe process creation events — one with 'user /add' and one with 'localgroup Administrators /add'. The two events will be within seconds of each other on the same host.
- Test 3Create Local Account via PowerShell New-LocalUser
Expected signal: Security Event ID 4720: TargetUserName=df00pstest, SubjectUserName=<current user>. Security Event ID 4732: member df00pstest added to Administrators group. Sysmon Event ID 1: powershell.exe process with CommandLine containing 'New-LocalUser' and 'Add-LocalGroupMember'. PowerShell ScriptBlock Log Event ID 4104 will capture the full cmdlet invocations with all parameters.
- Test 4Create Local Account on Linux with useradd
Expected signal: auditd SYSCALL records for execve of /usr/sbin/useradd with arguments '-m -s /bin/bash -G sudo df00linuxtest'. syslog or auth.log entry: 'new user: name=df00linuxtest, UID=<uid>, GID=<gid>, home=/home/df00linuxtest, shell=/bin/bash'. auditd USER_MGMT type record for account creation. /etc/passwd and /etc/shadow modification events if file auditing is enabled.
References (10)
- https://attack.mitre.org/techniques/T1136/001/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-entities
- https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day
- https://intezer.com/blog/research/hiddenwasp-malware-targeting-linux-systems/
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
- https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/
Unlock Pro Content
Get the full detection package for T1136.001 including response playbook, investigation guide, and atomic red team tests.