Query: write Sigma for Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab
Matching passage: Sigma rule: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab. Logsource: windows / process_creation. Rule: title: Suspicious Manipulation Of Default Accounts Via Net.EXE id: 5b768e71-86f2-4879-b448-81061cbae951 status: test description: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc references: - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_user_option: CommandLine|contains: ' user ' selection_username: CommandLine|contains: - ' Järjestelmänvalvoja ' - ' Rendszergazda ' - ' Администратор ' - ' Administrateur ' - ' Administrador ' - ' Administratör ' - ' Administrator ' - ' guest ' - ' DefaultAccount ' - ' "Järjestelmänvalvoja" ' - ' "Rendszergazda" ' - ' "Администратор" ' - ' "Administrateur" ' - ' "Administrador" ' - ' "Administratör" ' - ' "Administrator" ' - ' "guest" ' - ' "DefaultAccount" ' - ' ''Järjestelmänvalvoja'' ' - ' ''Rendszergazda'' ' - ' ''Администратор'' ' - ' ''Administrateur'' ' - ' ''Administrador'' ' - ' ''Administratör'' ' - ' ''Administrator'' ' - ' ''guest'' ' - ' ''DefaultAccount'' ' filter: CommandLine|contains|all: - guest - /active no condition: all of selection_* and not filter falsepositives: - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium level: high
Near-miss passage: Sigma rule: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Via Schtasks.EXE id: 92626ddd-662c-49e3-ac59-f6535f12d189 status: test description: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2025-10-22 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 - attack.s0111 - car.2013-08-001 - stp.1u logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains: ' /create ' filter_main_system_user: User|contains: - AUTHORI - AUTORI filter_optional_msoffice: ParentImage: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe Image: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe CommandLine|contains: Microsoft\Office\Office Performance Monitor condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity - Software installation level: low