create_local_admin_accounts_using_net_exe.yml

name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: This search looks for the creation of local administrator accounts using
  net.exe .
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine: '*/add*'
    Image|endswith:
    - net1.exe
    - net.exe
  selection2:
    CommandLine:
    - '*administratorer*'
    - '*amministratori*'
    - '*administrador*'
    - '*administrateurs*'
    - '*administratoren*'
    - '*administrators*'
  condition: selection1 and selection2
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
  model.
known_false_positives: Administrators often leverage net.exe to create admin accounts.
references: []
tags:
  analytic_story:
  - DHS Report TA18-074A
  - Azorult
  - CISA AA22-257A
  asset_type: Endpoint
  confidence: 60
  impact: 50
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators
    group.
  mitre_attack_id:
  - T1136.001
  - T1136
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 30
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
    source: WinEventLog:Security
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
    source: WinEventLog:System
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog