Sigma high test sigma

New User Created Via Net.EXE With Never Expire Option

Detects creation of local users via the net.exe command with the option "never expire"

View Source

Detection Logic

{
  "selection_img": [
    {
      "Image
| endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine
| contains
| all": [
      "user",
      "add",
      "expires:never"
    ]
  },
  "condition": "all of selection_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...