New account created
A new user account was created, in ANY log format.
What it detects
A new user account was created, in ANY log format. Attackers create accounts to keep access after the initial foothold (persistence) — a rogue local user, a new cloud identity, or a service account. This provider-agnostic rule keys on the canonical action the generic enrichment assigns to "useradd" / "net user" / "new user" / "user account created" phrases, so it fires even on a format we have no dedicated parser for.
MITRE ATT&CK mapping
- T1136Create Account· Persistence
False positives and triage
Onboarding and IT automation create accounts legitimately. The signal is an account created outside a change window, by an unexpected actor, or right after suspicious activity. Note that "net user" with no arguments only LISTS users — confirm the event actually created one, and review the new account name and who made it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/multi/new_account_created.yaml, licensed under the Apache License 2.0.
id: multi.persistence.new_account_created
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows, linux, macos, network, application]
mitre_techniques: [T1136]
description: |
A new user account was created, in ANY log format. Attackers create accounts to
keep access after the initial foothold (persistence) — a rogue local user, a new
cloud identity, or a service account. This provider-agnostic rule keys on the
canonical action the generic enrichment assigns to "useradd" / "net user" /
"new user" / "user account created" phrases, so it fires even on a format we
have no dedicated parser for.
match:
event_category: account
event_action_any:
- user_created
correlation_keys: [user_name]
false_positive_guidance: |
Onboarding and IT automation create accounts legitimately. The signal is an
account created outside a change window, by an unexpected actor, or right after
suspicious activity. Note that "net user" with no arguments only LISTS users —
confirm the event actually created one, and review the new account name and who
made it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.