Analytics BIOC Informational
✕

Local user account creation

A user was observed creating a rare local user account.

Module:
Identity Analytics
Data source:
Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Valid Accounts: Local Accounts (T1078.003)
Attacker's goals:

Persistence using a valid account.

Investigative actions:

Check the user who created the account and verify its activity. Investigate whether the same account was created on different hosts as part of an installation process.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Suspicious local user account creation Low (parent: Informational)