Suspicious Manipulation of Default Accounts via Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.