Hayabusa medium test sigma

Powershell LocalAccount Manipulation

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

View Source

Detection Logic

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection": {
    "ScriptBlockText
| contains": [
      "Disable-LocalUser",
      "Enable-LocalUser",
      "Get-LocalUser",
      "Set-LocalUser",
      "New-LocalUser",
      "Rename-LocalUser",
      "Remove-LocalUser"
    ]
  },
  "condition": "ps_script and selection"
}

False Positives

⚠ Legitimate administrative script

Field Validations

Loading…

Comments (0)

Loading comments...