Local Permission Group Discovery
Hypothesis and description
Cyber actors frequently enumerate local or domain permissions groups. The net utility is usually used for this purpose. This analytic looks for any instances of net.exe, which is not normally used for benign purposes, although system administrator actions may trigger false positives.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2020-11-30
- Contributors
- Olaf Hartong
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1069 Permission Groups DiscoveryT1069.001, T1069.002 | Discovery | Moderate |
1 technique, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
PseudocodePseudocode - net.exe instancesData model: CAR native
This is a pseudocode representation of the below splunk search.
processes = search Process:Create
net_processes = filter processes where (
exe = "net.exe" AND (
command_line="*net* user*" OR
command_line="*net* group*" OR
command_line="*net* localgroup*" OR
command_line="*get-localgroup*" OR
command_line="*get-ADPrincipalGroupMembership*" )
output net_processesSplunkSplunk Search - net.exe instancesData model: Sysmon native
Look for instances of net.exe
(index=__your_sysmon_index__ EventCode=1) Image="C:\\Windows\\System32\\net.exe" AND (CommandLine="* user*" OR CommandLine="* group*" OR CommandLine="* localgroup*" OR CommandLine="*get-localgroup*" OR CommandLine="*get-ADPrincipalGroupMembership*")LogPointLogPoint Search - net.exe instancesData model: LogPoint native
Look for instances of net.exe
norm_id=WindowsSysmon event_id=1 image="C:\Windows\System32\net.exe" (command="* user*" OR command="* group*" OR command="* localgroup*" OR command="*get-localgroup*" OR command="*get-ADPrincipalGroupMembership*")