Analytics BIOC Informational
✕

Uncommon net localgroup command execution

Uncommon net localgroup command execution which may be used for group and user enumeration and unauthorized user creation.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007) Persistence (TA0003)
ATT&CK techniques: Permission Groups Discovery (T1069) Create Account (T1136)
Attacker's goals:

Attackers may attempt to use the command to find local groups permissions settings or modify local memberships.

Investigative actions:

Check if the queried group is a sensitive one (e.g. administrators). Check whether the initiating process has executed additional discovery commands.

Test period:
N/A (single event)
Deduplication:
1 Day
8 variations:
  • Uncommon net localgroup command execution by an RMM CGO Low (parent: Informational)
  • Uncommon net localgroup administrators command execution by a web server process or CGO Medium (parent: Informational)
  • Uncommon unsigned net localgroup administrators command execution Medium (parent: Informational)
  • Uncommon unsigned net localgroup administrators command execution - fixed localization issues Medium (parent: Informational)
  • Uncommon net localgroup administrators command execution Low (parent: Informational)
  • Uncommon net localgroup execution Low (parent: Informational)
  • Uncommon remote net localgroup execution Medium (parent: Informational)
  • Uncommon administrator net localgroup execution by scripting engine or command prompt Low (parent: Informational)