Powershell LocalAccount Manipulation

Title: Powershell LocalAccount Manipulation
Status: test
Description:Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
Author: frack113
Date: 2021-12-28
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'Disable-LocalUser'
      -'Enable-LocalUser'
      -'Get-LocalUser'
      -'Set-LocalUser'
      -'New-LocalUser'
      -'Rename-LocalUser'
      -'Remove-LocalUser'

  condition:selection
Falsepositives:
  -Legitimate administrative script
Level: medium