huntrule

PowerShell Local Account Creation via New-LocalUser

Flags PowerShell usage of New-LocalUser, indicating creation of a Windows local user.

FreeUnreviewedSigmamediumv1
title: PowerShell Local Account Creation via New-LocalUser
id: f721a8dc-c2d6-494f-8810-de366c4dd07d
status: test
description: This rule detects PowerShell script content that invokes New-LocalUser, indicating local user account creation on Windows. Creating accounts can be used by attackers to establish persistence or gain additional access beyond existing credentials. The detection relies on PowerShell script block text telemetry from enabled script block logging.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml
author: "@ROxPinTeddy, Huntrule Team"
date: 2020-04-11
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1059.001
  - attack.persistence
  - attack.t1136.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: New-LocalUser
  condition: selection
falsepositives:
  - Legitimate user creation
level: medium
license: DRL-1.1
related:
  - id: 243de76f-4725-4f2e-8225-a8a69b15ad61
    type: derived

What it detects

This rule detects PowerShell script content that invokes New-LocalUser, indicating local user account creation on Windows. Creating accounts can be used by attackers to establish persistence or gain additional access beyond existing credentials. The detection relies on PowerShell script block text telemetry from enabled script block logging.

Known false positives

  • Legitimate user creation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.