Password Provided In Command Line Of Net.EXE

Title: Password Provided In Command Line Of Net.EXE
Status: test
Description:Detects a when net.exe is called with a password in the command line
References:
  -Internal Research
Author: Tim Shelton (HAWK.IO)
Date: 2021-12-09
modified:2023-02-21
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.lateral-movement'
• -'attack.stealth'
• -'attack.t1021.002'
• -'attack.t1078'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    - OriginalFileName:
      - 'net.exe'
      - 'net1.exe'
  selection_cli:
    CommandLine|contains|all:
      -' use '
      -':*\\'
      -'/USER:* *'

  filter_main_empty:
    CommandLine|endswith: ' '
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium