← Back to SOC feed Coverage →

Create account (1)

kql MEDIUM Azure-Sentinel
DeviceEvents
huntingmicrosoftofficialpersistence
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-23T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may create user accounts to establish persistence and maintain long-term access to a system. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential long-term threats and unauthorized access.

KQL Query


// Query #2: Query for accounts created on machines onboarded with Sense.
// Create account event is noisy, so we need to join it with some other signal.
// E.g. In this query we look for accounts created which name resembles "administrator".
//      Using account names similar to known common account names is a common way to be evade the human analyst eye.
DeviceEvents
| where ActionType == "UserAccountCreated"
// To look for account names similar to administrator, we'll simply query for the prefix and suffix,
// because these letters matter most to the human perception: https://en.wikipedia.org/wiki/Typoglycemia
// Calculating distance functions is possible but will be much more complicated - 
// and looking for prefix and suffix should work in this case pretty well.
| where AccountName startswith "ad" and AccountName endswith "or" and AccountName !~ "administrator"
// Note: For the UserAccountCreated event we do not know the details of the process / account that was used to create this new account.
| project AccountName, AccountDomain, DeviceName, Timestamp
| limit 100

Analytic Rule Definition

id: eba83f84-b844-4fc9-96f4-cb51b0b20c1d
name: Create account (1)
description: |
  User accounts may be created to achieve persistence on a machine.
  Read more here: https://attack.mitre.org/wiki/Technique/T1136.
  Tags: #CreateAccount.
  Query #1: Query for users being created using "net user" command.
  "net user" commands are noisy, so needs to be joined with another signal -.
  E.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add).
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |2-

  // Query #2: Query for accounts created on machines onboarded with Sense.
  // Create account event is noisy, so we need to join it with some other signal.
  // E.g. In this query we look for accounts created which name resembles "administrator".
  //      Using account names similar to known common account names is a common way to be evade the human analyst eye.
  DeviceEvents
  | where ActionType == "UserAccountCreated"
  // To look for account names similar to administrator, we'll simply query for the prefix and suffix,
  // because these letters matter most to the human perception: https://en.wikipedia.org/wiki/Typoglycemia
  // Calculating distance functions is possible but will be much more complicated - 
  // and looking for prefix and suffix should work in this case pretty well.
  | where AccountName startswith "ad" and AccountName endswith "or" and AccountName !~ "administrator"
  // Note: For the UserAccountCreated event we do not know the details of the process / account that was used to create this new account.
  | project AccountName, AccountDomain, DeviceName, Timestamp
  | limit 100

Required Data Sources

Sentinel TableNotes
DeviceEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Persistence/Create account (1).yaml