Analytics BIOC Informational
✕

Uncommon net group command execution

Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007) Persistence (TA0003)
ATT&CK techniques: Permission Groups Discovery (T1069) Create Account (T1136)
Attacker's goals:

Attackers may attempt to use the command to find domain-level group permissions settings or modify domain-level memberships.

Investigative actions:

Check if the queried group is a sensitive one (e.g. administrators). Check whether the initiating process has executed additional discovery commands.

Test period:
N/A (single event)
Deduplication:
1 Day
7 variations:
  • Uncommon unsigned net group administrators command execution High (parent: Informational)
  • Uncommon unsigned net group administrators command execution - fixed localization issues High (parent: Informational)
  • Uncommon remote net group administrators command execution Low (parent: Informational)
  • Uncommon net group administrators command execution Medium (parent: Informational)
  • Uncommon net group execution Low (parent: Informational)
  • Uncommon remote net group execution Low (parent: Informational)
  • Uncommon administrator net group execution by scripting engine or command prompt Medium (parent: Informational)