Users
Users answers: who used the host - each account once, with every source that knows it.
At a glance
Question | Who used the host? |
Reads | The local account database, the Administrators group, user profiles on disk, the sessions signed in now, and account changes in the Security log. |
Works best with | User Account Management and Security Group Management auditing. |
Not on | Domain controllers: their local database is the domain's. Leave Users out there. |
Rule prefix |
|
What it reads
Source | Evidence |
|---|---|
The local account database (the same calls as |
|
The Administrators group, by SID |
|
The profile list and the profiles folder |
|
Sessions signed in now (console and Remote Desktop) |
|
Security log account changes (created, enabled, reset, deleted, added to groups) |
|
Signals it raises
11 rules: 4 high, 6 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | An account was set to need no password, no Kerberos pre-authentication, or a reversible password |
|
|
| high | A local account's name ends in $ |
|
|
| high | A local account is named like a Windows identity |
|
|
| high | SID history was added to an account |
|
|
| medium | A user account was created |
|
|
| medium | A member was added to the local Administrators group |
|
|
| medium | A broad group is a member of the local Administrators group |
|
|
| medium | An account was enabled again after a long time disabled | run facts |
|
| medium | The Guest account is enabled |
|
|
| medium | An account's password was reset by another account |
|
|
| low | A user account was deleted |
|
|
How to read it
The accounts table: each account with its kind (person, service, default...), scope (local, domain, Microsoft, Entra), whether it is enabled and an administrator, its last password change and logon, whether it is signed in now, its profile, and every change recorded - with who made it.
Signal's own session is left out of "signed in now".
Windows Setup and a domain join create accounts and group memberships; Signal leaves those known events out so they do not look like an intruder's.
What it can't see
Next
LogIntegrity: can the host's logs be trusted?