Account Created with Name Matching System Account

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the creation of a new user account on a Windows system via SMB (port 445) where the account name contains 'svc_' and the 'NetUserAdd' function is used. This could indicate an attacker creating a service account with a name that mimics legitimate system accounts to evade detection.