Detect Create Account in Google Chronicle

rule t1136_create_account {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects account creation activity covering Windows Security Event 4720, process-based creation via net.exe/wmic/PowerShell, and Linux useradd. Maps to MITRE ATT&CK T1136."
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1136"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      // Branch 1: Windows Security Event 4720 (User Account Created)
      $e.metadata.event_type = "USER_CREATION" and
      $e.metadata.product_event_type = "4720" and
      $e.principal.hostname != ""
    )
    or
    (
      // Branch 2: net.exe or net1.exe /add
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        re.regex($e.target.process.file.full_path, `(?i)(net|net1)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)user.*/add`)
      )
    )
    or
    (
      // Branch 3: wmic useraccount create
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path, `(?i)wmic\.exe$`) and
      re.regex($e.target.process.command_line, `(?i)useraccount.*create`)
    )
    or
    (
      // Branch 4: PowerShell New-LocalUser
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
      re.regex($e.target.process.command_line, `(?i)(New-LocalUser|net user.*\/add)`)
    )
    or
    (
      // Branch 5: Linux useradd / adduser
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path, `(?i)(useradd|adduser)$`)
    )

  condition:
    $e
}