Suspicious Group And Account Reconnaissance Activity Using Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Mar 2, 2023•0•0•1

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)