Crowdstrike Ephemeral User Account

Description

Detects when a user account is created and deleted within 12 hours. This aims to detect ephemeral user accounts infiltrators might use to avoid suspicion.

Query

Detection:
  - Sequence:
      - ID: AccountCreated
        RuleID: Crowdstrike.NewUserCreated
      - ID: AccountDeleted
        RuleID: Crowdstrike.UserDeleted
    Transitions:
      - ID: User Created FOLLOWED BY User Deleted
        From: AccountCreated
        To: AccountDeleted
        WithinTimeFrameMinutes: 720 # 12 hours
        Match:
          - On: p_alert_context.target_name
    LookbackWindowMinutes: 2160
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 1

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source Crowdstrike Ephemeral User Account · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Crowdstrike.EphemeralUserAccount"
DisplayName: "Crowdstrike Ephemeral User Account"
Enabled: true
Severity: High
Description: Detects when a user account is created and deleted within 12 hours. This aims to detect ephemeral user accounts infiltrators might use to avoid suspicion.
Reference: ""
Reports:
  MITRE ATT&CK:
    - TA0003:T1136.003 # Persistence: Create Cloud Account
    - TA0005:T1070 # Defense Evasion: Indicator Removal
Detection:
  - Sequence:
      - ID: AccountCreated
        RuleID: Crowdstrike.NewUserCreated
      - ID: AccountDeleted
        RuleID: Crowdstrike.UserDeleted
    Transitions:
      - ID: User Created FOLLOWED BY User Deleted
        From: AccountCreated
        To: AccountDeleted
        WithinTimeFrameMinutes: 720 # 12 hours
        Match:
          - On: p_alert_context.target_name
    LookbackWindowMinutes: 2160
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 1
Tests:
  - Name: User Creation, Followed By Deletion
    ExpectedResult: true
    RuleOutputs:
      - ID: AccountCreated
        Matches:
          p_alert_context.target_name:
            'non.chalant@legitbiz.com':
              - 0
      - ID: AccountDeleted
        Matches:
          p_alert_context.target_name:
            'non.chalant@legitbiz.com':
              - 640 # 9 hours
  - Name: User Creation, Not Followed By Deletion
    ExpectedResult: false
    RuleOutputs:
      - ID: AccountCreated
        Matches:
          p_alert_context.target_name:
            'non.chalant@legitbiz.com':
              - 0
  - Name: User Deletion, Not Preceded By Creation
    ExpectedResult: false
    RuleOutputs:
      - ID: AccountDeleted
        Matches:
          p_alert_context.target_name:
            'non.chalant@legitbiz.com':
              - 120 # 2 hours

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.