Sigma rule: Suspicious Manipulation Of Default Accounts Via Net.EXE

Rule

Title

Suspicious Manipulation Of Default Accounts Via Net.EXE

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-09-01

Modified

2023-02-21

File

rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\net.exe'
          - '\net1.exe'
    - OriginalFileName:
          - 'net.exe'
          - 'net1.exe'
selection_user_option:
    CommandLine|contains: ' user '
selection_username:
    CommandLine|contains:
        # Note: We need to write the full account name for cases starting with 'admin' to avoid lookups only with the user flag
        - ' Järjestelmänvalvoja ' # Finish
        - ' Rendszergazda ' # Hungarian
        - ' Администратор ' # Russian
        - ' Administrateur ' # French
        - ' Administrador ' # Portuguese (Brazil + Portugal) + Spanish
        - ' Administratör ' # Swedish
        - ' Administrator ' # English
        - ' guest '
        - ' DefaultAccount '
        # The cases below are for when an attacker requests the net command via 'cmd /c....'
        # First in double quotes
        - ' "Järjestelmänvalvoja" ' # Finish
        - ' "Rendszergazda" ' # Hungarian
        - ' "Администратор" ' # Russian
        - ' "Administrateur" ' # French
        - ' "Administrador" ' # Portuguese (Brazil + Portugal) + Spanish
        - ' "Administratör" ' # Swedish
        - ' "Administrator" ' # English
        - ' "guest" '
        - ' "DefaultAccount" '
        # Second in single quotes
        - " 'Järjestelmänvalvoja' " # Finish
        - " 'Rendszergazda' " # Hungarian
        - " 'Администратор' " # Russian
        - " 'Administrateur' " # French
        - " 'Administrador' " # Portuguese (Brazil + Portugal) + Spanish
        - " 'Administratör' " # Swedish
        - " 'Administrator' " # English
        - " 'guest' "
        - " 'DefaultAccount' "
filter:
    CommandLine|contains|all:
        - 'guest'
        - '/active no'
condition: all of selection_* and not filter

False positives (as the rule lists them)

• Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium

Tags

• attack.collection
• attack.t1560.001

MITRE ATT&CK ids this rule names

• T1560.001

References

• https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
• https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
• https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml