Suspicious Manipulation Of Default Accounts Via Net.EXE

Title: Suspicious Manipulation Of Default Accounts Via Net.EXE
Status: test
Description:Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
References:
  -https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
  -https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
  -https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-01
modified:2023-02-21
Tags:

• -'attack.collection'
• -'attack.t1560.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    - OriginalFileName:
      - 'net.exe'
      - 'net1.exe'
  selection_user_option:
    CommandLine|contains: ' user '
  selection_username:
    CommandLine|contains:
      -' Järjestelmänvalvoja '
      -' Rendszergazda '
      -' Администратор '
      -' Administrateur '
      -' Administrador '
      -' Administratör '
      -' Administrator '
      -' guest '
      -' DefaultAccount '
      -' "Järjestelmänvalvoja" '
      -' "Rendszergazda" '
      -' "Администратор" '
      -' "Administrateur" '
      -' "Administrador" '
      -' "Administratör" '
      -' "Administrator" '
      -' "guest" '
      -' "DefaultAccount" '
      -' 'Järjestelmänvalvoja' '
      -' 'Rendszergazda' '
      -' 'Администратор' '
      -' 'Administrateur' '
      -' 'Administrador' '
      -' 'Administratör' '
      -' 'Administrator' '
      -' 'guest' '
      -' 'DefaultAccount' '

  filter:
    CommandLine|contains|all:
      -'guest'
      -'/active no'

  condition:all of selection_* and not filter
Falsepositives:
  -Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium
Level: high