Hide Navigation Hide TOC

Suspicious Group And Account Reconnaissance Activity Using Net.EXE (d95de845-b83c-4a9a-8a6a-4fc802ebf6c0)

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Suspicious Group And Account Reconnaissance Activity Using Net.EXE (d95de845-b83c-4a9a-8a6a-4fc802ebf6c0)	Sigma-Rules	Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	1
Suspicious Group And Account Reconnaissance Activity Using Net.EXE (d95de845-b83c-4a9a-8a6a-4fc802ebf6c0)	Sigma-Rules	Domain Account - T1087.002 (21875073-b0ee-49e3-9077-1e2a885359af)	Attack Pattern	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	2
Domain Account - T1087.002 (21875073-b0ee-49e3-9077-1e2a885359af)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	2