Windows Security 4720: Hidden Local User Account Creation

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

FreeUnreviewedSigmahighv1

windows-security-4720-hidden-local-user-account-creation-7b449a5e

title: "Windows Security 4720: Hidden Local User Account Creation"
id: 794497ff-b1b1-4bc0-b0de-845766acf2c5
status: test
description: This rule flags Windows Security events indicating a local user account was created with a username ending in '$', which commonly denotes a hidden local account. Attackers may use hidden accounts to persist on a system while reducing visibility during casual inspection. The detection relies on Windows Security auditing event ID 4720 and filters out the specific known username 'HomeGroupUser$' to reduce expected noise.
references:
  - https://twitter.com/SBousseaden/status/1387743867663958021
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hidden_user_creation.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-05-03
modified: 2024-01-16
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4720
    TargetUserName|endswith: $
  filter_main_homegroup:
    TargetUserName: HomeGroupUser$
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
    type: derived

What it detects

This rule flags Windows Security events indicating a local user account was created with a username ending in '$', which commonly denotes a hidden local account. Attackers may use hidden accounts to persist on a system while reducing visibility during casual inspection. The detection relies on Windows Security auditing event ID 4720 and filters out the specific known username 'HomeGroupUser$' to reduce expected noise.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.