Windows Security: Detect Local User Creation (Event ID 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

FreeUnreviewedSigmalowv1

windows-security-detect-local-user-creation-event-id-4720-66b6be3d

title: "Windows Security: Detect Local User Creation (Event ID 4720)"
id: 5566d69c-c29b-49eb-b681-332bff940c29
status: test
description: This rule identifies the creation of a local user account on Windows systems by matching Security Event ID 4720. Attackers may use local accounts to establish persistent access when domain-based activity is monitored or restricted. It relies on Windows Security log telemetry that records user account creation events.
references:
  - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_creation.yml
author: Patrick Bareiss, Huntrule Team
date: 2019-04-18
modified: 2021-01-17
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4720
  condition: selection
falsepositives:
  - Domain Controller Logs
  - Local accounts managed by privileged account management tools
level: low
license: DRL-1.1
related:
  - id: 66b6be3d-55d0-4f47-9855-d69df21740ea
    type: derived

What it detects

This rule identifies the creation of a local user account on Windows systems by matching Security Event ID 4720. Attackers may use local accounts to establish persistent access when domain-based activity is monitored or restricted. It relies on Windows Security log telemetry that records user account creation events.

Known false positives

Domain Controller Logs
Local accounts managed by privileged account management tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.