Windows Security: Suspicious Local Account Creation with ANONYMOUS LOGON Account Name

Alerts on Windows local account creation where the new SamAccountName contains “ANONYMOUS” and “LOGON”.

FreeUnreviewedSigmahighv1

windows-security-suspicious-local-account-creation-with-anonymous-logon-account--1bbf25b9

title: "Windows Security: Suspicious Local Account Creation with ANONYMOUS LOGON Account Name"
id: 481553c6-0952-40e1-97af-0645c7ece9f6
status: test
description: This rule flags Windows Security events where a local account is created with a SamAccountName containing both “ANONYMOUS” and “LOGON” in the name. Attackers may use account naming patterns resembling ANONYMOUS LOGON to blend in with expected system/authentication artifacts or to establish persistence via misleading local accounts. Detection relies on Windows Security auditing for account creation (EventID 4720) and the created account’s SamAccountName text content.
references:
  - https://twitter.com/SBousseaden/status/1189469425482829824
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_local_anon_logon_created.yml
author: James Pemberton / @4A616D6573, Huntrule Team
date: 2019-10-31
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1136.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4720
    SamAccountName|contains|all:
      - ANONYMOUS
      - LOGON
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1bbf25b9-8038-4154-a50b-118f2a32be27
    type: derived

What it detects

This rule flags Windows Security events where a local account is created with a SamAccountName containing both “ANONYMOUS” and “LOGON” in the name. Attackers may use account naming patterns resembling ANONYMOUS LOGON to blend in with expected system/authentication artifacts or to establish persistence via misleading local accounts. Detection relies on Windows Security auditing for account creation (EventID 4720) and the created account’s SamAccountName text content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.