Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE. This rule identifies attempts to enumerate local or domain groups and accounts, specifically looking for commands that list members of sensitive groups like 'domain admins' or 'enterprise admins', or general account information. It filters out commands that are used to add users or groups to reduce false positives. The rule also includes checks for common administrative group names in multiple languages.
Sigma
