MITRE CAR unknown stable spl

Create local admin accounts using net exe

This search looks for the creation of local administrator accounts using net.exe.

View Source

Detection Logic

| tstats count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe 
OR Processes.process_name=net1.exe) 
AND (Processes.process=*localgroup* 
OR Processes.process=*/add* 
OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
| `create_local_admin_accounts_using_net_exe_filter`

Field Validations

Loading…

Comments (0)

Loading comments...