{"id":"5b768e71-86f2-4879-b448-81061cbae951","title":"Suspicious Manipulation Of Default Accounts Via Net.EXE","description":"Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-01","modified":"2023-02-21","tags":["attack.collection","attack.t1560.001"],"technique_ids":["T1560.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium"],"references":["https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html","https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/","https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/"],"source_path":"rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml","source_sha256":"a2d722d2b488bc3b8ddd6746f66687a3ee7d08fd7f41e99bccbcc4334b6cc363","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Manipulation Of Default Accounts Via Net.EXE\nid: 5b768e71-86f2-4879-b448-81061cbae951\nstatus: test\ndescription: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc\nreferences:\n    - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html\n    - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/\n    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-01\nmodified: 2023-02-21\ntags:\n    - attack.collection\n    - attack.t1560.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\net.exe'\n              - '\\net1.exe'\n        - OriginalFileName:\n              - 'net.exe'\n              - 'net1.exe'\n    selection_user_option:\n        CommandLine|contains: ' user '\n    selection_username:\n        CommandLine|contains:\n            # Note: We need to write the full account name for cases starting with 'admin' to avoid lookups only with the user flag\n            - ' Järjestelmänvalvoja ' # Finish\n            - ' Rendszergazda ' # Hungarian\n            - ' Администратор ' # Russian\n            - ' Administrateur ' # French\n            - ' Administrador ' # Portuguese (Brazil + Portugal) + Spanish\n            - ' Administratör ' # Swedish\n            - ' Administrator ' # English\n            - ' guest '\n            - ' DefaultAccount '\n            # The cases below are for when an attacker requests the net command via 'cmd /c....'\n            # First in double quotes\n            - ' \"Järjestelmänvalvoja\" ' # Finish\n            - ' \"Rendszergazda\" ' # Hungarian\n            - ' \"Администратор\" ' # Russian\n            - ' \"Administrateur\" ' # French\n            - ' \"Administrador\" ' # Portuguese (Brazil + Portugal) + Spanish\n            - ' \"Administratör\" ' # Swedish\n            - ' \"Administrator\" ' # English\n            - ' \"guest\" '\n            - ' \"DefaultAccount\" '\n            # Second in single quotes\n            - \" 'Järjestelmänvalvoja' \" # Finish\n            - \" 'Rendszergazda' \" # Hungarian\n            - \" 'Администратор' \" # Russian\n            - \" 'Administrateur' \" # French\n            - \" 'Administrador' \" # Portuguese (Brazil + Portugal) + Spanish\n            - \" 'Administratör' \" # Swedish\n            - \" 'Administrator' \" # English\n            - \" 'guest' \"\n            - \" 'DefaultAccount' \"\n    filter:\n        CommandLine|contains|all:\n            - 'guest'\n            - '/active no'\n    condition: all of selection_* and not filter\nfalsepositives:\n    - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1560.001","id":"T1560.001","name":"Archive via Utility","page":"techniques/enterprise/T1560.001/"}],"data_path":"data/detection-rules/5b768e71-86f2-4879-b448-81061cbae951.json","kind":"sigma"}