PowerShell Local Account Manipulation

Adversaries often manipulate local user accounts on compromised Windows systems to maintain persistent access or escalate privileges. This activity involves the use of standard PowerShell cmdlets from the Microsoft.PowerShell.LocalAccounts module, which are frequently abused for tasks such as creating new backdoored accounts, renaming existing accounts to evade detection, or modifying account permissions. Because these cmdlets are legitimate administrative tools, their usage is common in enterprise environments, making it difficult to distinguish between benign system administration and malicious unauthorized activity. Monitoring Script Block Logging (Event ID 4104) is critical for capturing the command-line parameters used during these operations, as attackers typically execute these commands via obfuscated scripts or direct interactive shells. Defenders should baseline common administrative behavior to reduce the noise associated with these detections.

Impact

Successful manipulation of local accounts allows an attacker to establish long-term persistence, bypass credential expiration policies, or elevate privileges, significantly increasing the difficulty of eviction. Organizations that do not monitor for account modification events may fail to detect the unauthorized creation or takeover of local accounts, potentially leading to unauthorized data access and lateral movement across the internal network.

Recommendation

Deploy the provided Sigma rule to capture unauthorized account manipulation attempts and tune for environment-specific administrative scripts.

• Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints.
• Implement monitoring for the use of LocalAccount cmdlets in scripts or interactive sessions.
• Establish a baseline of authorized administrative tasks to filter out false positives from legitimate management tools.