forked from elastic/detection-rules
-
Notifications
You must be signed in to change notification settings - Fork 0
/
net_user_add.py
40 lines (31 loc) · 1.28 KB
/
net_user_add.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License
# 2.0; you may not use this file except in compliance with the Elastic License
# 2.0.
# Name: Create User with net.exe
# RTA: net_user_add.py
# ATT&CK: T1136
# signal.rule.name: User Account Creation
# Description: Adds an account to the local host using the net.exe command
from . import common
@common.requires_os(common.WINDOWS)
def main():
common.log("Creating local and domain user accounts using net.exe")
commands = [
'net.exe user macgyver $w!$$@rmy11 /add /fullname:"Angus Macgyver"',
'net.exe user macgyver $w!$$@rmy11 /add /fullname:"Angus Macgyver" /domain',
'net.exe group Administrators macgyver /add',
'net.exe group "Domain Admins" macgyver /add /domain',
'net.exe localgroup Administrators macgyver /add',
]
for cmd in commands:
common.execute(cmd)
cleanup_commands = [
"net.exe user macgyver /delete",
"net.exe user macgyver /delete /domain"
]
common.log("Removing local and domain user accounts using net.exe", log_type="-")
for cmd in cleanup_commands:
common.execute(cmd)
if __name__ == "__main__":
exit(main())