PowerShell Local User Account Manipulation via ScriptBlock Logging on Windows

Alerts when PowerShell script blocks invoke local user management cmdlets that can be used to maintain persistence.

FreeUnreviewedSigmamediumv1

powershell-local-user-account-manipulation-via-scriptblock-logging-on-windows-4fdc44df

title: PowerShell Local User Account Manipulation via ScriptBlock Logging on Windows
id: 851ea7e0-a9f8-4347-9eae-c2f4dfbba10e
status: test
description: This rule flags PowerShell script block activity that includes commands used to manage local user accounts, such as disabling/enabling, creating, renaming, retrieving, setting, or removing users. Adversaries can abuse local account modification to maintain or regain access after compromise by changing account state or credentials/attributes. The detection relies on Windows PowerShell Script Block Logging telemetry capturing the presence of specific LocalAccounts cmdlets in the script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_localuser.yml
author: frack113, Huntrule Team
date: 2021-12-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Disable-LocalUser
      - Enable-LocalUser
      - Get-LocalUser
      - Set-LocalUser
      - New-LocalUser
      - Rename-LocalUser
      - Remove-LocalUser
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
    type: derived

What it detects

This rule flags PowerShell script block activity that includes commands used to manage local user accounts, such as disabling/enabling, creating, renaming, retrieving, setting, or removing users. Adversaries can abuse local account modification to maintain or regain access after compromise by changing account state or credentials/attributes. The detection relies on Windows PowerShell Script Block Logging telemetry capturing the presence of specific LocalAccounts cmdlets in the script text.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.