Query: detect Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab in logs
Matching passage: Sigma rule: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab. Logsource: windows / process_creation. Rule: title: Suspicious Manipulation Of Default Accounts Via Net.EXE id: 5b768e71-86f2-4879-b448-81061cbae951 status: test description: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc references: - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_user_option: CommandLine|contains: ' user ' selection_username: CommandLine|contains: - ' Järjestelmänvalvoja ' - ' Rendszergazda ' - ' Администратор ' - ' Administrateur ' - ' Administrador ' - ' Administratör ' - ' Administrator ' - ' guest ' - ' DefaultAccount ' - ' "Järjestelmänvalvoja" ' - ' "Rendszergazda" ' - ' "Администратор" ' - ' "Administrateur" ' - ' "Administrador" ' - ' "Administratör" ' - ' "Administrator" ' - ' "guest" ' - ' "DefaultAccount" ' - ' ''Järjestelmänvalvoja'' ' - ' ''Rendszergazda'' ' - ' ''Администратор'' ' - ' ''Administrateur'' ' - ' ''Administrador'' ' - ' ''Administratör'' ' - ' ''Administrator'' ' - ' ''guest'' ' - ' ''DefaultAccount'' ' filter: CommandLine|contains|all: - guest - /active no condition: all of selection_* and not filter falsepositives: - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / security. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - Security id: 7a922f1b-2635-4d6c-91ef-af228b198ad3 related: - id: 175997c5-803c-4b08-8bb0-70b099f47595 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - new-object - text.encoding]::ascii - readtoend ServiceFileName|contains: - system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium