Uncommon net group command execution

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Informational

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Variations

Uncommon unsigned net group administrators command execution

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	High

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon unsigned net group administrators command execution - fixed localization issues

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	High

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon remote net group administrators command execution

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Low

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon net group administrators command execution

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Medium

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon net group execution

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Low

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon remote net group execution

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Low

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.

Uncommon administrator net group execution by scripting engine or command prompt

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Permission Groups Discovery (T1069), Create Account (T1136)
Severity	Medium

Description

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Attacker's Goals

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions

• Check if the queried group is a sensitive one (e.g. administrators).
• Check whether the initiating process has executed additional discovery commands.