Uncovering Local Windows Account Creation via Command Line with KQL

When adversaries establish an initial foothold with local administrator access, they often create a persistent local user account to ensure continued access if their initial implant is removed. They frequently promote this account to the local Administrators group.

Here is how to catch local account creation across both command-line process events and Windows Security Event logs.

Method 1: Defender Process Telemetry (DeviceProcessEvents)

// Detect net user /add and net localgroup administrators /add commands
let timeFrame = 7d;
DeviceProcessEvents
| where TimeGenerated >= ago(timeFrame)
| where FileName in~ ("net.exe", "net1.exe")
| where (ProcessCommandLine has "user" and ProcessCommandLine has "/add")
     or (ProcessCommandLine has "localgroup" and ProcessCommandLine has_any ("administrators", "admin") and ProcessCommandLine has "/add")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Method 2: Windows Event ID 4720 (SecurityEvent)

Event 4720 triggers on domain controllers and workstations whenever a local or domain user account is created:

SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4720
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, TargetDomainName, Activity
| order by TimeGenerated desc

Triage Checklist

• Is this device part of an automated workstation deployment pool running setup scripts?
• Does the TargetUserName look like an administrative masquerade (e.g., admin_support, svc_backup)?
• If unauthorized, disable the account immediately via Disable-LocalUser and investigate the host for initial access roots.

MITRE ATT&CK Mapping

• Tactic: Persistence (TA0003)
• Technique: Create Account: Local Account (T1136.001)