create_local_admin_accounts_using_net_exe.yml

name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 7
date: '2023-11-07'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: |-
  The following analytic detects the creation of local administrator accounts using the net.exe command to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding to potential threats earlier and taking appropriate actions to protect the organization's systems and data. This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" parameter and have specific keywords related to administrator accounts in their process name. This detection is important because the creation of unauthorized local administrator accounts might indicate that an attacker has successfully created a new administrator account and is trying to gain persistent access to a system or escalate their privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe command and the creation of administrator accounts in certain circumstances. You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, review the details of the identified process, including the user, parent process, and parent process name. Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
  user values(Processes.parent_process) as parent_process values(parent_process_name)
  as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
  where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add*
  AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR
  Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori*
  OR Processes.process=*administratorer*) by Processes.process Processes.process_name Processes.parent_process_name
  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
  telemetry from the endpoints where the agent is installed. To implement this search,
  you must ingest logs that contain the process GUID, process name, and parent process.
  Additionally, you must ingest complete command-line executions. These logs must
  be processed using the appropriate Splunk Technology Add-ons that are specific to
  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
  data model. Use the Splunk Common Information Model (CIM) to normalize the field
  names and speed up the data modeling process.
known_false_positives: Administrators often leverage net.exe to create admin accounts.
references: []
tags:
  analytic_story:
  - DHS Report TA18-074A
  - Azorult
  - CISA AA22-257A
  - DarkGate Malware
  asset_type: Endpoint
  confidence: 60
  impact: 50
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators
    group.
  mitre_attack_id:
  - T1136.001
  - T1136
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.original_file_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 30
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
    source: WinEventLog:Security
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
    source: WinEventLog:System
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog