Detect Local Account in Sumo Logic CSE
Adversaries may create a local account to maintain persistent access to victim systems. Local accounts can be created using built-in OS commands such as net user /add (Windows), useradd or adduser (Linux), or dscl -create (macOS). Adversaries including Wizard Spider, APT5, Fox Kitten, TeamTNT, and FIN13 have used this technique to establish secondary access that survives credential rotation and does not require persistent remote access tools. Created accounts are often added to the local Administrators group to maximize their utility. Common naming patterns observed in the wild include service-like names (supportaccount, HelpAssistant) designed to blend with legitimate accounts.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1136 Create Account
- Sub-technique
- T1136.001 Local Account
- Canonical reference
- https://attack.mitre.org/techniques/T1136/001/
Sumo Detection Query
((_sourceCategory=*windows* OR _sourceCategory=*WinEventLog* OR _sourceCategory=*sysmon*)
AND (EventCode=4720 OR EventCode=4732 OR (EventCode=1 AND (Image=*\\net.exe OR Image=*\\net1.exe))))
| parse "EventCode=*" as EventCode nodrop
| parse "Account_Name:\t\t*" as CreatedAccount nodrop
| parse "Group_Name:\t\t*" as GroupName nodrop
| parse "CommandLine:\t*" as CommandLine nodrop
| parse "Image:\t*" as Image nodrop
| parse "ParentImage:\t*" as ParentImage nodrop
| parse "Computer:\t*" as host nodrop
| where (EventCode = "4720")
OR (EventCode = "4732" AND (GroupName = "Administrators" OR GroupName = "Remote Desktop Users" OR GroupName = "Remote Management Users" OR GroupName = "Backup Operators"))
OR (EventCode = "1" AND (CommandLine matches "(?i).*\\buser\\b.*" AND CommandLine matches "(?i).*/add.*"))
| eval SuspiciousName = if(matches(toLowerCase(CreatedAccount), ".*(support|helpdesk|helpasst|helpassist|admin|svc|service|backup|test|temp|guest|user1|user2|anonymous).*"), 1, 0)
| eval SuspiciousParent = if(matches(toLowerCase(ParentImage), ".*(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|cmd).*"), 1, 0)
| eval Hour = format("%tH", _messageTime)
| eval OffHours = if(num(Hour) < 7 OR num(Hour) >= 20, 1, 0)
| eval SuspicionScore = SuspiciousName + SuspiciousParent + OffHours
| eval DetectionBranch = if(EventCode = "4720", "SecurityEvent_4720",
if(EventCode = "4732", "SecurityEvent_4732_GroupAdd",
if(EventCode = "1", "Sysmon_NetUserAdd", "Unknown")))
| fields _messagetime, host, EventCode, DetectionBranch, CreatedAccount, GroupName, CommandLine, ParentImage, SuspicionScore
| sort by _messagetime descDetects local account creation via Windows Security Events 4720 and 4732, and process execution of net.exe/net1.exe with /add argument via Sysmon Event 1. Calculates a suspicion score based on account naming patterns, parent process risk, and off-hours timing.
Data Sources
Required Tables
False Positives & Tuning
- IT provisioning scripts creating local admin accounts during new server builds or OS deployments
- Backup software agents (Veeam, Commvault) that create local service accounts during installation
- Pentest tools or red team exercises conducted without proper exclusion filters applied
Other platforms for T1136.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Local User Account with Net User
Expected signal: Security Event ID 4720 in Windows Security log: TargetUserName=df00testuser, SubjectUserName=<current admin account>. Sysmon Event ID 1: Image=net.exe or net1.exe, CommandLine containing 'user df00testuser /add'. Security Event ID 4722 (account enabled) will follow immediately.
- Test 2Create Local Account and Add to Administrators Group
Expected signal: Security Event ID 4720: account df00admintest created. Security Event ID 4732: member df00admintest added to Administrators group. Sysmon Event ID 1: two sequential net.exe process creation events — one with 'user /add' and one with 'localgroup Administrators /add'. The two events will be within seconds of each other on the same host.
- Test 3Create Local Account via PowerShell New-LocalUser
Expected signal: Security Event ID 4720: TargetUserName=df00pstest, SubjectUserName=<current user>. Security Event ID 4732: member df00pstest added to Administrators group. Sysmon Event ID 1: powershell.exe process with CommandLine containing 'New-LocalUser' and 'Add-LocalGroupMember'. PowerShell ScriptBlock Log Event ID 4104 will capture the full cmdlet invocations with all parameters.
- Test 4Create Local Account on Linux with useradd
Expected signal: auditd SYSCALL records for execve of /usr/sbin/useradd with arguments '-m -s /bin/bash -G sudo df00linuxtest'. syslog or auth.log entry: 'new user: name=df00linuxtest, UID=<uid>, GID=<gid>, home=/home/df00linuxtest, shell=/bin/bash'. auditd USER_MGMT type record for account creation. /etc/passwd and /etc/shadow modification events if file auditing is enabled.
References (10)
- https://attack.mitre.org/techniques/T1136/001/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-entities
- https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day
- https://intezer.com/blog/research/hiddenwasp-malware-targeting-linux-systems/
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
- https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/
Unlock Pro Content
Get the full detection package for T1136.001 including response playbook, investigation guide, and atomic red team tests.