Windows Security: New or Renamed User Account Name Contains '$'

title: "Windows Security: New or Renamed User Account Name Contains '$'"
id: 9c236287-52b4-44da-b98a-921618858bfe
status: test
description: This rule flags creation or renaming of Windows user accounts where the account name includes the '$' character. Attackers may use this to disguise accounts or interfere with monitoring systems that do not handle such characters consistently. It relies on Windows Security events for user creation (EventID 4720) and user rename (EventID 4781) and checks the relevant account name fields for the '$' character, excluding the specific HomeGroupUser$ case.
references:
  - https://twitter.com/SBousseaden/status/1387743867663958021
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2024-01-16
tags:
  - attack.stealth
  - attack.t1036
logsource:
  product: windows
  service: security
detection:
  selection_create:
    EventID: 4720
    SamAccountName|contains: $
  selection_rename:
    EventID: 4781
    NewTargetUserName|contains: $
  filter_main_homegroup:
    EventID: 4720
    TargetUserName: HomeGroupUser$
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cfeed607-6aa4-4bbd-9627-b637deb723c8
    type: derived