huntrule

Windows: Local user creation via net.exe with expires:never

Flags net.exe user add commands that set expires:never for local account persistence.

FreeUnreviewedSigmahighv1
title: "Windows: Local user creation via net.exe with expires:never"
id: a72424a6-c674-4858-beae-19d43229d097
related:
  - id: cd219ff3-fa99-45d4-8380-a7d15116c6dc
    type: derived
  - id: b9f0e6f5-09b4-4358-bae4-08408705bd5c
    type: derived
status: test
description: This rule identifies creation of local accounts using net.exe (net.exe or net1.exe) when the command line includes the user/add parameters and the option expires:never. Attackers may use this to create persistent accounts that do not expire. The detection relies on Windows process creation telemetry, matching the executing image name and command-line contents.
references:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2023-02-21
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains|all:
      - user
      - add
      - expires:never
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies creation of local accounts using net.exe (net.exe or net1.exe) when the command line includes the user/add parameters and the option expires:never. Attackers may use this to create persistent accounts that do not expire. The detection relies on Windows process creation telemetry, matching the executing image name and command-line contents.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.