Monitoring Local User Account Creation on Windows

The creation of local user accounts on Windows systems is a common post-exploitation activity used by adversaries to establish persistence or facilitate lateral movement and privilege escalation. Monitoring for this behavior is essential for security operations centers to identify unauthorized access attempts. This activity is logged via Windows Security Audit event ID 4720. While legitimate administrative actions may trigger this event, such occurrences are often anomalous and should be thoroughly investigated. Defenders should verify new account creation against known administrative change windows. Due to potential noise, organizations may choose to tune the detection logic by excluding Domain Controllers or focusing on high-value, critical infrastructure systems.

Impact

Successful exploitation of this technique allows an attacker to maintain persistent access to a compromised host, bypass original credential requirements, or escalate privileges within the environment. If left undetected, this can lead to unauthorized access to sensitive systems and data, potentially facilitating further lateral movement throughout the enterprise network.

Recommendation

• Enable Group Management Audit logs in the Local Windows Security Policy to ensure event ID 4720 is generated.
• Implement the detection rule provided below to flag new local user account creation in your SIEM.
• Establish a workflow to verify all triggered alerts with system administrators to filter out legitimate account provisioning.
• Consider creating an exclusion list for known service accounts or administrative task automation to reduce false positives.