EXPLORE
Sign In
← Back to Explore
sigmahighHunting

Suspicious Windows ANONYMOUS LOGON Local Account Created

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

MITRE ATT&CK

T1136.001T1136.002
persistence

Detection Query

selection:
  EventID: 4720
  SamAccountName|contains|all:
    - ANONYMOUS
    - LOGON
condition: selection

Author

James Pemberton / @4A616D6573

Created

2019-10-31

Data Sources

windowssecurity

Platforms

windows

References

Tags

attack.persistenceattack.t1136.001attack.t1136.002
Raw Content
title: Suspicious Windows ANONYMOUS LOGON Local Account Created
id: 1bbf25b9-8038-4154-a50b-118f2a32be27
status: test
description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
references:
    - https://twitter.com/SBousseaden/status/1189469425482829824
author: James Pemberton / @4A616D6573
date: 2019-10-31
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1136.001
    - attack.t1136.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
        SamAccountName|contains|all:
            - 'ANONYMOUS'
            - 'LOGON'
    condition: selection
falsepositives:
    - Unknown
level: high