Suspicious Manipulation Of Default Accounts Via Net.EXE

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_user_option": {
    "CommandLine
| contains": " user "
  },
  "selection_username": {
    "CommandLine
| contains": [
      " Järjestelmänvalvoja ",
      " Rendszergazda ",
      " Администратор ",
      " Administrateur ",
      " Administrador ",
      " Administratör ",
      " Administrator ",
      " guest ",
      " DefaultAccount ",
      " \"Järjestelmänvalvoja\" ",
      " \"Rendszergazda\" ",
      " \"Администратор\" ",
      " \"Administrateur\" ",
      " \"Administrador\" ",
      " \"Administratör\" ",
      " \"Administrator\" ",
      " \"guest\" ",
      " \"DefaultAccount\" ",
      " 'Järjestelmänvalvoja' ",
      " 'Rendszergazda' ",
      " 'Администратор' ",
      " 'Administrateur' ",
      " 'Administrador' ",
      " 'Administratör' ",
      " 'Administrator' ",
      " 'guest' ",
      " 'DefaultAccount' "
    ]
  },
  "filter": {
    "CommandLine
| contains
| all": [
      "guest",
      "/active no"
    ]
  },
  "condition": "process_creation and (all of selection_* and not filter)"
}

False Positives

• ⚠ Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium