Sigma rule: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Rule

Title

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)

Date

2019-01-16

Modified

2023-03-02

File

rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\net.exe'
          - '\net1.exe'
    - OriginalFileName:
          - 'net.exe'
          - 'net1.exe'
# Covers group and localgroup flags
selection_group_root:
    CommandLine|contains:
        - ' group '
        - ' localgroup '
selection_group_flags:
    CommandLine|contains:
        # Add more groups for other languages
        - 'domain admins'
        - ' administrator' # Typo without an 'S' so we catch both
        - ' administrateur' # Typo without an 'S' so we catch both
        - 'enterprise admins'
        - 'Exchange Trusted Subsystem'
        - 'Remote Desktop Users'
        - 'Utilisateurs du Bureau à distance' # French for "Remote Desktop Users"
        - 'Usuarios de escritorio remoto' # Spanish for "Remote Desktop Users"
        - ' /do' # short for domain
filter_group_add:
    # This filter is added to avoid the potential case where the point is not recon but addition
    CommandLine|contains: ' /add'
# Covers 'accounts' flag
selection_accounts_root:
    CommandLine|contains: ' accounts '
selection_accounts_flags:
    CommandLine|contains: ' /do' # short for domain
condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*)

False positives (as the rule lists them)

• Inventory tool runs
• Administrative activity

Tags

• attack.discovery
• attack.t1087.001
• attack.t1087.002

MITRE ATT&CK ids this rule names

• T1087.001
• T1087.002

References

• https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
• https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
• https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml