Vendor: Microsoft

Product: Sysmon

Use-Case: Account Manipulation

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
15	6	12	1	1

Event Type	Rules	Models
process-created	T1531 - Account Access Removal ↳ NET-EXE-DELETE-ORG-F: First time net.exe has been used to delete a user account by this user. ↳ NET-EXE-DELETE-ORG-A: Abnormal usage of net.exe to delete a user account by this user. T1078 - Valid Accounts ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1098 - Account Manipulation ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1136 - Create Account ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. T1136.001 - Create Account: Create: Local Account ↳ AC-OZ-CLI-F: First zone on which account was created using CLI command ↳ AC-OH-CLI-F: First host on which account was created using CLI command ↳ NET-EXE-ADD-ORG-F: First time net.exe has been used to create a user account by this user. ↳ NET-EXE-ADD-ORG-A: Abnormal usage of net.exe to create a user account by this user. T1021.003 - T1021.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1059.001 - Command and Scripting Interperter: PowerShell ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1059.003 - T1059.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1218.010 - Signed Binary Proxy Execution: Regsvr32 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1559.002 - T1559.002 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1003 - OS Credential Dumping ↳ A-ShadowCP-SymLink: Shadow Copies Access via Symlink on this asset ↳ ShadowCP-SymLink: Shadow Copies Access via Symlink T1003.003 - T1003.003 ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset	• NET-EXE-DELETE-ORG: Using net.exe to delete a user account • NET-EXE-ACTIVE-ORG: Using net.exe to disable/enable a user account • NET-EXE-ADD-GRP-ORG: Using net.exe to add a group account • NET-EXE-ADD-ORG: Using net.exe to add a user account • AC-OH-CLI: Hosts on which account was created using CLI command • AC-OZ-CLI: Zones on which account was created using CLI command