Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)
Flags net.exe/net1.exe process creation when command lines reference built-in Administrator/guest/default accounts with suspicious active/disable context.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-01
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies suspicious Windows command-line usage of net.exe or net1.exe to target built-in default accounts such as Administrator and guest, including localized account names and DefaultAccount. Attackers may use these commands to enable/disable accounts or change credentials to maintain access and disrupt normal security baselines. It relies on process creation telemetry, matching net.exe execution and filtering for command lines that include guest plus '/active no'.
Reporting behind it
- trellix.comhttps://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
- redacted.comhttps://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
- microsoft.comhttps://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)
id: 30d52a84-d483-4582-9bd0-5d01abf8823a
status: test
description: This rule identifies suspicious Windows command-line usage of net.exe or net1.exe to target built-in default accounts such as Administrator and guest, including localized account names and DefaultAccount. Attackers may use these commands to enable/disable accounts or change credentials to maintain access and disrupt normal security baselines. It relies on process creation telemetry, matching net.exe execution and filtering for command lines that include guest plus '/active no'.
references:
- https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
- https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
- https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-02-21
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \net.exe
- \net1.exe
- OriginalFileName:
- net.exe
- net1.exe
selection_user_option:
CommandLine|contains: " user "
selection_username:
CommandLine|contains:
- " Järjestelmänvalvoja "
- " Rendszergazda "
- " Администратор "
- " Administrateur "
- " Administrador "
- " Administratör "
- " Administrator "
- " guest "
- " DefaultAccount "
- ' "Järjestelmänvalvoja" '
- ' "Rendszergazda" '
- ' "Администратор" '
- ' "Administrateur" '
- ' "Administrador" '
- ' "Administratör" '
- ' "Administrator" '
- ' "guest" '
- ' "DefaultAccount" '
- " 'Järjestelmänvalvoja' "
- " 'Rendszergazda' "
- " 'Администратор' "
- " 'Administrateur' "
- " 'Administrador' "
- " 'Administratör' "
- " 'Administrator' "
- " 'guest' "
- " 'DefaultAccount' "
filter:
CommandLine|contains|all:
- guest
- /active no
condition: all of selection_* and not filter
falsepositives:
- Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium
level: high
license: DRL-1.1
related:
- id: 5b768e71-86f2-4879-b448-81061cbae951
type: derived