Query: rule covering Detects creation of local users via the net.exe command with the option "never expire"
Matching passage: Sigma rule: Detects creation of local users via the net.exe command with the option "never expire". Logsource: windows / process_creation. Rule: title: New User Created Via Net.EXE With Never Expire Option id: b9f0e6f5-09b4-4358-bae4-08408705bd5c related: - id: cd219ff3-fa99-45d4-8380-a7d15116c6dc type: derived status: test description: Detects creation of local users via the net.exe command with the option "never expire" references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2023-02-21 tags: - attack.persistence - attack.t1136.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - user - add - expires:never condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation By Uncommon Source Image id: 66d31e5f-52d6-40a4-9615-002d3789a119 related: - id: 02d1d718-dd13-41af-989d-ea85c7fab93f type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-07-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \explorer.exe - \iexplore.exe - \msiexec.exe - \powerpnt.exe - \schtasks.exe - \winlogon.exe filter_main_winlogon_1: SourceImage: C:\Windows\System32\winlogon.exe TargetImage: - C:\Windows\System32\services.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\wlrmdr.exe - C:\Windows\System32\AtBroker.exe - C:\Windows\System32\dwm.exe - C:\Windows\System32\fontdrvhost.exe - C:\Windows\System32\userinit.exe filter_main_winlogon_2: SourceImage: C:\Windows\System32\winlogon.exe TargetParentProcessId: 4 filter_main_schtasks_conhost: SourceImage: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_explorer: SourceImage: C:\Windows\explorer.exe TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ filter_main_system: TargetImage: System filter_main_msiexec_1: SourceImage|endswith: \msiexec.exe TargetImage|contains: - \AppData\Local\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\Microsoft.NET\Framework64\ filter_main_msiexec_2: SourceImage|endswith: \msiexec.exe TargetImage: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_iexplore: SourceImage: C:\Program Files\Internet Explorer\iexplore.exe TargetImage: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Windows\System32\rundll32.exe filter_main_powerpnt: SourceImage|endswith: \POWERPNT.EXE TargetImage|contains: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ filter_optional_aurora_smartconsole1: SourceImage: C:\Program Files\internet explorer\iexplore.exe SourceCommandLine|contains|all: - https:// - .checkpoint.com/documents/ - SmartConsole_OLH/ - default.htm#cshid= filter_optional_aurora_smartconsole2: SourceImage: C:\Program Files\internet