Sigma rule: Local User Creation

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-c2b7bb39a072, updated 2021-01-17T00:00:00.000Z.

Rule

Title: Local User Creation
Status: test
Level: low
Author: Patrick Bareiss
Date: 2019-04-18
Modified: 2021-01-17
File: rules/windows/builtin/security/win_security_user_creation.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Log source

product: windows
service: security

Detection

selection:
    EventID: 4720
condition: selection

False positives (as the rule lists them)

Domain Controller Logs
Local accounts managed by privileged account management tools

MITRE ATT&CK ids this rule names

T1136.001

References

https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_user_creation.yml

Sources and licences

SigmaHQ
"Local User Creation" by Patrick Bareiss (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_user_creation.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Local User Creation",
entity page, dataset version ref-c2b7bb39a072, updated 2021-01-17T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/66b6be3d-55d0-4f47-9855-d69df21740ea (accessed 2026-11-03).
Underlying source: SigmaHQ rule 66b6be3d-55d0-4f47-9855-d69df21740ea, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.