Possible Local User Creation (via security)

title: Possible Local User Creation (via security)
id: 47aa231b-de99-5edb-8ee8-ff0716f0e5a1
status: stable
description: This rule detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
references:
    - https://attack.mitre.org/techniques/T1136/001/
    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
author: Huntrule Team
date: 2026-06-21
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
falsepositives:
    - Unknown
level: low