Query: Sigma rule for Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed
Matching passage: Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed. Logsource: windows / process_creation. Rule: title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0 status: test description: 'Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM) ' references: - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-03-02 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_group_root: CommandLine|contains: - ' group ' - ' localgroup ' selection_group_flags: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto - ' /do' filter_group_add: CommandLine|contains: ' /add' selection_accounts_root: CommandLine|contains: ' accounts ' selection_accounts_flags: CommandLine|contains: ' /do' condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*) falsepositives: - Inventory tool runs - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discover. Logsource: windows / process_creation. Rule: title: Suspicious Use of PsLogList id: aae1243f-d8af-40d8-ab20-33fc6d0c55bc status: test description: Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs references: - https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/ - https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList - https://twitter.com/EricaZelic/status/1614075109827874817 author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2026-06-29 tags: - attack.discovery - attack.t1087 - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: psloglist.exe - Image|endswith: - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe selection_cli_eventlog: CommandLine|contains: - ' security' - ' application' - ' system' selection_cli_flags: CommandLine|contains|windash: - ' -d' - ' -x' - ' -s' - ' -c' - ' -g' condition: all of selection_* falsepositives: - Another tool that uses the command line switches of PsLogList - Legitimate use of PsLogList by an administrator level: medium