Windows: Local user creation via net.exe using DarkGate and SafeMode arguments

Alerts on net.exe adding a local user when the command line includes “DarkGate” and “SafeMode”.

FreeUnreviewedSigmahighv1

windows-local-user-creation-via-net-exe-using-darkgate-and-safemode-arguments-bf906d7b

title: "Windows: Local user creation via net.exe using DarkGate and SafeMode arguments"
id: d124c7d4-ae3f-43e8-b0c3-646e93e11fba
status: test
description: This rule flags Windows process creation where net.exe (or net1.exe) is used to add a local user with command-line parameters containing both “DarkGate” and “SafeMode”. Adding users via built-in networking utilities can be used to establish persistence or create additional access pathways. It relies on process creation telemetry, matching the image path ending in net.exe/net1.exe and specific substrings present in the full command line.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_net_user_creation.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-08-27
modified: 2023-10-15
tags:
  - attack.persistence
  - attack.t1136.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains|all:
      - user
      - add
      - DarkGate
      - SafeMode
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: bf906d7b-7070-4642-8383-e404cf26eba5
    type: derived

What it detects

This rule flags Windows process creation where net.exe (or net1.exe) is used to add a local user with command-line parameters containing both “DarkGate” and “SafeMode”. Adding users via built-in networking utilities can be used to establish persistence or create additional access pathways. It relies on process creation telemetry, matching the image path ending in net.exe/net1.exe and specific substrings present in the full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.