Detection rules › Sigma

New User Created Via Net.EXE With Never Expire Option

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects creation of local users via the net.exe command with the option "never expire"

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1136.001 Create Account: Local Account

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\net.exe'
Image|endswith: '\net1.exe'
OriginalFileName: net.exe
OriginalFileName: net1.exe

Stage 2: all of selection_cli

CommandLine|contains: add
CommandLine|contains: 'expires:never'
CommandLine|contains: user

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • add corpus 16 (sigma 16)
  • expires:never
  • user corpus 4 (sigma 4)
Imageends_with
  • \net.exe corpus 27 (sigma 27)
  • \net1.exe corpus 25 (sigma 25)
OriginalFileNameeq
  • net.exe corpus 16 (sigma 16)
  • net1.exe corpus 16 (sigma 16)