PowerShell Create Local User

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.