Uncommon user management via net command

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Informational

Description

The net command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.

Variations

Uncommon user management via net command by a renamed lolbin

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Medium

Description

The net command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts. The actor process's PE original file name identifies it as a known lolbin, but its on-disk file name differs, indicating the lolbin was renamed - a technique malware and malicious actors often use to evade detection.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.

Uncommon user management via net command by a web server process or CGO

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Medium

Description

The net command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts. When executed from a web server, it might be executed from an installed Webshell.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.

Uncommon user management via net command by an untrusted CGO

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Medium

Description

The net command is used to add, delete, and otherwise manage the users on a computer by an untrusted CGO. Adversaries may attempt to use the command to discover or add local and domain user accounts.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.

Uncommon user management via net command by an untrusted actor process

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Low

Description

The net command is used to add, delete, and otherwise manage the users on a computer by an untrusted actor process. Adversaries may attempt to use the command to discover or add local and domain user accounts.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.

Uncommon user management via net command by a remote management tool (RMM)

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007), Persistence (TA0003)
ATT&CK Technique	Account Discovery (T1087), Create Account (T1136)
Severity	Low

Description

The net command is used to add, delete, and otherwise manage the users on a computer by a remote management tool (RMM). Adversaries may attempt to use the command to discover or add local and domain user accounts.

Attacker's Goals

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it.
• Check whether the user from the command line is an administrator or other sensitive account.