Create new user with known DEV-0270 username and password

Description

Search for the creation of a new user using a known DEV-0270 username/password schema.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessCommandLine has_all('net user', '/add') 
| parse InitiatingProcessCommandLine with * "user " username " "* 
| extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) 
| where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')
Raw source Create new user with known DEV-0270 username and password · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f2e7c61a-6e29-4ddf-ac2e-97eb7b37d621
name: Create new user with known DEV-0270 username and password
description: |
  Search for the creation of a new user using a known DEV-0270 username/password schema.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Persistence
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessCommandLine has_all('net user', '/add') 
  | parse InitiatingProcessCommandLine with * "user " username " "* 
  | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) 
  | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.