User properties enumeration via commandline

Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate local users via commandline.

Known false positives

Pentest
Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1087.001` Account Discovery: Local Account `T1087.002` Account Discovery: Domain Account

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: User properties enumeration via commandline
description: Detects scenarios where an attacker attempts to enumerate local users via commandline.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
- https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
- https://attack.mitre.org/software/S0039/
tags:
- attack.discovery
- attack.t1087.001
- attack.t1087.002
author: mdecrevoisier
logsource:
  product: windows
  category: process_creation
detection:
  selection: # Full command example: 'net user administrator [/domain]'
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains:
      - net
      - user
      - domain
  filter:
    CommandLine|contains: add # refers to another use case for user creation via commandline
  condition: selection and not filter
falsepositives:
- Pentest
- Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  NewProcessName|endswith:
    - \net1.exe
    - \net.exe
  CommandLine|contains:
    - net
    - user
    - domain

Stage 2: `not filter`

filter:
  CommandLine|contains: add

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`add`	`excludes:CommandLine` `field:"CommandLine" value:"add"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`domain` corpus 2 (sigma 2) `net` corpus 7 (sigma 7) `user` corpus 17 (sigma 11, splunk 4, chronicle 2)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\net.exe` corpus 49 (sigma 49) `\net1.exe` corpus 47 (sigma 47)	`field:"Image" kind:ends_with`

User properties enumeration via commandline

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`