Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)

Flags net.exe/net1.exe process creation when command lines reference built-in Administrator/guest/default accounts with suspicious active/disable context.

FreeUnreviewedSigmahighv1

windows-net-exe-commands-manipulating-built-in-default-accounts-administrator-gu-5b768e71

title: Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)
id: 30d52a84-d483-4582-9bd0-5d01abf8823a
status: test
description: This rule identifies suspicious Windows command-line usage of net.exe or net1.exe to target built-in default accounts such as Administrator and guest, including localized account names and DefaultAccount. Attackers may use these commands to enable/disable accounts or change credentials to maintain access and disrupt normal security baselines. It relies on process creation telemetry, matching net.exe execution and filtering for command lines that include guest plus '/active no'.
references:
  - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-02-21
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_user_option:
    CommandLine|contains: " user "
  selection_username:
    CommandLine|contains:
      - " Järjestelmänvalvoja "
      - " Rendszergazda "
      - " Администратор "
      - " Administrateur "
      - " Administrador "
      - " Administratör "
      - " Administrator "
      - " guest "
      - " DefaultAccount "
      - ' "Järjestelmänvalvoja" '
      - ' "Rendszergazda" '
      - ' "Администратор" '
      - ' "Administrateur" '
      - ' "Administrador" '
      - ' "Administratör" '
      - ' "Administrator" '
      - ' "guest" '
      - ' "DefaultAccount" '
      - " 'Järjestelmänvalvoja' "
      - " 'Rendszergazda' "
      - " 'Администратор' "
      - " 'Administrateur' "
      - " 'Administrador' "
      - " 'Administratör' "
      - " 'Administrator' "
      - " 'guest' "
      - " 'DefaultAccount' "
  filter:
    CommandLine|contains|all:
      - guest
      - /active no
  condition: all of selection_* and not filter
falsepositives:
  - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium
level: high
license: DRL-1.1
related:
  - id: 5b768e71-86f2-4879-b448-81061cbae951
    type: derived

What it detects

This rule identifies suspicious Windows command-line usage of net.exe or net1.exe to target built-in default accounts such as Administrator and guest, including localized account names and DefaultAccount. Attackers may use these commands to enable/disable accounts or change credentials to maintain access and disrupt normal security baselines. It relies on process creation telemetry, matching net.exe execution and filtering for command lines that include guest plus '/active no'.

Known false positives

Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.