Disabled guest or builtin account activated (command)

Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enables a disabled builtin account via command line.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Disabled guest or builtin account activated (command)
description: Detects scenarios where an attacker enables a disabled builtin account via command line.
references:
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
logsource:
  product: windows
  category: process_creation
detection:
  selection: # Full command example: 'net user DefaultAccount /active:yes'
    EventID: 4688
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains|all:
      - user
      - active
      - 'yes'
    CommandLine|contains:
      - Guest
      - DefaultAccount
      - support_388945a0   # Remote assistance
      - HelpAssistant      # Managed by Remote Desktop Help Session Manager service
      - WDAGUtilityAccount # Defender Application Guard
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith:
    - \net1.exe
    - \net.exe
  CommandLine|contains|all:
    - user
    - active
    - 'yes'
  CommandLine|contains:
    - Guest
    - DefaultAccount
    - support_388945a0
    - HelpAssistant
    - WDAGUtilityAccount

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`DefaultAccount` `Guest` `HelpAssistant` `WDAGUtilityAccount` `active` `support_388945a0` `user` corpus 17 (sigma 11, splunk 4, chronicle 2) `yes` corpus 3 (sigma 2, splunk 1)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\net.exe` corpus 49 (sigma 49) `\net1.exe` corpus 47 (sigma 47)	`field:"Image" kind:ends_with`

Disabled guest or builtin account activated (command)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`