Analytics BIOC Informational
✕

Uncommon user management via net.exe

The net.exe command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007) Persistence (TA0003)
ATT&CK techniques: Account Discovery (T1087) Create Account (T1136)
Attacker's goals:

Attackers may attempt to use the command to discover or add local and domain user accounts. The created accounts are to gain additional access to endpoints within your network.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Check whether the user from the command line is an administrator or other sensitive account.

Test period:
N/A (single event)
Deduplication:
1 Day