Skip to content
This repository has been archived by the owner on Nov 16, 2023. It is now read-only.

Commit

Permalink
Merge pull request #113 from rosenmoore/master
Browse files Browse the repository at this point in the history 
improve detection of use of net.exe on CLI
  • Loading branch information
@tali-ash
tali-ash authored Apr 22, 2020
2 parents 8169752 + ead0612 commit b31f46c
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Discovery/Enumeration of users & groups for lateral movement.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName == 'net.exe' and AccountName != "" and ProcessCommandLine !contains '\\' and ProcessCommandLine !contains '/add'
| where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine endswith ' /do' or ProcessCommandLine endswith ' /domain')
| where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine contains ' /do' or ProcessCommandLine contains ' /domain')
| extend Target = extract("(?i)[user|group] (\"*[a-zA-Z0-9-_ ]+\"*)", 1, ProcessCommandLine) | filter Target != ''
| project AccountName, Target, ProcessCommandLine, DeviceName, Timestamp
| sort by AccountName, Target
| sort by AccountName, Target

0 comments on commit b31f46c

Please sign in to comment.