SignalHunt
← All rules

WIN-1004

low

New User Account Created

Detects creation of a new local or domain user account (EventID 4720). On its own this is low severity (routine IT/HR activity); it becomes high severity when the same account is added to a privileged group shortly after (see WIN-1003) or is created outside change-management windows.

T1136.001T1136.002

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 4720
  }
}

Log source: product=windows, service=security · Event ID(s): 4720

Required log fields

  • SubjectUserName
  • SubjectUserSid
  • TargetUserName
  • TargetSid

Enabling this in your environment

Where: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Account Management > Audit User Account Management 

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Enable on all domain controllers, not just member servers, so account creation is visible even when it happens directly against AD.

False positives

  • Routine account provisioning by IT/HR - correlate with your ticketing system

References