Windows PowerShell Local User Account Manipulation via Script Block Logging
Alerts when PowerShell script blocks invoke local user management cmdlets that can be used to maintain persistence.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-28
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block activity that contains commands used to enumerate, create, modify, enable/disable, rename, or remove local user accounts. Such actions can help an attacker maintain persistence or preserve access by changing local credentials and user states on the host. It relies on Script Block Logging telemetry that captures the executed PowerShell text and matches specific LocalAccounts cmdlets.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_localuser.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Local User Account Manipulation via Script Block Logging
id: 851ea7e0-a9f8-4347-9eae-c2f4dfbba10e
status: test
description: This rule flags PowerShell script block activity that contains commands used to enumerate, create, modify, enable/disable, rename, or remove local user accounts. Such actions can help an attacker maintain persistence or preserve access by changing local credentials and user states on the host. It relies on Script Block Logging telemetry that captures the executed PowerShell text and matches specific LocalAccounts cmdlets.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_localuser.yml
author: frack113, Huntrule Team
date: 2021-12-28
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1098
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- Disable-LocalUser
- Enable-LocalUser
- Get-LocalUser
- Set-LocalUser
- New-LocalUser
- Rename-LocalUser
- Remove-LocalUser
condition: selection
falsepositives:
- Legitimate administrative script
level: medium
license: DRL-1.1
related:
- id: 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
type: derived