Enumeration of users & groups for lateral movement

Description

The query finds attempts to list users or groups using Net commands.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(14d) 
| where FileName == 'net.exe' and AccountName != "" and ProcessCommandLine !contains '\\'  and ProcessCommandLine !contains '/add' 
| where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine contains ' /do' or ProcessCommandLine contains ' /domain') 
| extend Target = extract("(?i)[user|group] (\"*[a-zA-Z0-9-_ ]+\"*)", 1, ProcessCommandLine) | filter Target  != '' 
| project AccountName, Target, ProcessCommandLine, DeviceName, Timestamp  
| sort by AccountName, Target
Raw source Enumeration of users & groups for lateral movement · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: dde6f931-559e-4e21-9409-6286de59771e
name: Enumeration of users & groups for lateral movement
description: |
  The query finds attempts to list users or groups using Net commands.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(14d) 
  | where FileName == 'net.exe' and AccountName != "" and ProcessCommandLine !contains '\\'  and ProcessCommandLine !contains '/add' 
  | where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine contains ' /do' or ProcessCommandLine contains ' /domain') 
  | extend Target = extract("(?i)[user|group] (\"*[a-zA-Z0-9-_ ]+\"*)", 1, ProcessCommandLine) | filter Target  != '' 
  | project AccountName, Target, ProcessCommandLine, DeviceName, Timestamp  
  | sort by AccountName, Target

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.