New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Enumeration of Administrator Accounts Security Software Discovery using WMIC »
Elastic Docs ›Elastic Security Solution [8.7] ›Downloadable rule update v0.14.2

Net command via SYSTEM account

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Net command via SYSTEM account

edit

Identifies the SYSTEM account using an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Discovery

Version: 8

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
process where event.type in ("start", "process_started") and
  user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  process.name : "whoami.exe" or
  (process.name : "net1.exe" and not process.parent.name : "net.exe")

Framework: MITRE ATT&CKTM

« Enumeration of Administrator Accounts Security Software Discovery using WMIC »

On this page

Was this helpful?
Feedback