Existing account altered to weaken or extend its credentials

Siemphony@siemphonylowT1098unverified

AN0265 asks for account attribute changes correlated with unusual process lineage or timing. The correlation half is not expressible — its TimeWindow knob wants a five-minute join between a suspicious process and a directory change, and its SubjectTargetMismatch knob wants the modifying account compared against the modified one, and lib/sigma has no timeframe, no aggregation and no field-to-field comparison. So this rule takes the analytic's process-creation leg alone and keeps it at the parent technique: it matches the commands that alter an account that already exists in ways that preserve or broaden an adversary's hold on it — clearing the password requirement, lifting expiry, re-enabling a dormant account, resetting a password, or bolting a service principal name onto a user so it becomes Kerberoastable. The two account-control flags that matter most here, PasswordNeverExpires and DoesNotRequirePreAuth, are matched only when a setting cmdlet appears on the same command line, because those two words are far more often typed in a `Get-ADUser -Filter`/`-Properties` audit query — an enumeration that belongs to T1087, not here — than in an actual write. Group membership changes are deliberately excluded even though the analytic's other log source lists EventID 4728, because adding an account to a local or domain group is T1098.007 and belongs in that brief, not under the parent tag. Two limits worth stating before deployment. The brief sources this leg from Sysmon EventID 1, which records CommandLine natively; if the site feeds Security EventID 4688 into the same `process_creation` category instead, *Audit Process Creation* and the separate *Include command line in process creation events* policy must both be enabled or every term below is blind and the rule returns zero rows that read as quiet rather than deaf. And because this is process-creation only, a cmdlet invoked inside a .ps1 body, from a DLL, or over LDAP by a compiled tool leaves nothing here — the directory-side events would, but this rule is not written in their vocabulary. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0096, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " user ") and (ProcessCommandLine contains "/active:yes" or ProcessCommandLine contains "/expires:never" or ProcessCommandLine contains "/passwordreq:no" or ProcessCommandLine contains "/passwordchg:no" or ProcessCommandLine contains "/logonpasswordchg:no" or ProcessCommandLine contains "/times:all")) or (ProcessCommandLine contains "Set-ADAccountPassword" or ProcessCommandLine contains "Set-ADAccountControl" or ProcessCommandLine contains "Set-LocalUser" or ProcessCommandLine contains "Enable-LocalUser" or ProcessCommandLine contains "Enable-ADAccount")) or ((ProcessCommandLine contains "PasswordNeverExpires" or ProcessCommandLine contains "DoesNotRequirePreAuth" or ProcessCommandLine contains "AllowReversiblePasswordEncryption") and (ProcessCommandLine contains "Set-ADUser" or ProcessCommandLine contains "Set-ADAccountControl" or ProcessCommandLine contains "Set-LocalUser"))) or (FolderPath endswith "\\setspn.exe" and (ProcessCommandLine contains " -a " or ProcessCommandLine contains " -s ")))

Splunk · SPL

Run this as a search.

index=* ((((((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* user *") AND (CommandLine="*/active:yes*" OR CommandLine="*/expires:never*" OR CommandLine="*/passwordreq:no*" OR CommandLine="*/passwordchg:no*" OR CommandLine="*/logonpasswordchg:no*" OR CommandLine="*/times:all*")) OR (CommandLine="*Set-ADAccountPassword*" OR CommandLine="*Set-ADAccountControl*" OR CommandLine="*Set-LocalUser*" OR CommandLine="*Enable-LocalUser*" OR CommandLine="*Enable-ADAccount*")) OR ((CommandLine="*PasswordNeverExpires*" OR CommandLine="*DoesNotRequirePreAuth*" OR CommandLine="*AllowReversiblePasswordEncryption*") AND (CommandLine="*Set-ADUser*" OR CommandLine="*Set-ADAccountControl*" OR CommandLine="*Set-LocalUser*"))) OR (Image="*\\setspn.exe" AND (CommandLine="* -a *" OR CommandLine="* -s *")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* user *") AND (TO_LOWER(process.command_line) LIKE "*/active:yes*" OR TO_LOWER(process.command_line) LIKE "*/expires:never*" OR TO_LOWER(process.command_line) LIKE "*/passwordreq:no*" OR TO_LOWER(process.command_line) LIKE "*/passwordchg:no*" OR TO_LOWER(process.command_line) LIKE "*/logonpasswordchg:no*" OR TO_LOWER(process.command_line) LIKE "*/times:all*")) OR (TO_LOWER(process.command_line) LIKE "*set-adaccountpassword*" OR TO_LOWER(process.command_line) LIKE "*set-adaccountcontrol*" OR TO_LOWER(process.command_line) LIKE "*set-localuser*" OR TO_LOWER(process.command_line) LIKE "*enable-localuser*" OR TO_LOWER(process.command_line) LIKE "*enable-adaccount*")) OR ((TO_LOWER(process.command_line) LIKE "*passwordneverexpires*" OR TO_LOWER(process.command_line) LIKE "*doesnotrequirepreauth*" OR TO_LOWER(process.command_line) LIKE "*allowreversiblepasswordencryption*") AND (TO_LOWER(process.command_line) LIKE "*set-aduser*" OR TO_LOWER(process.command_line) LIKE "*set-adaccountcontrol*" OR TO_LOWER(process.command_line) LIKE "*set-localuser*"))) OR (TO_LOWER(process.executable) LIKE "*\\\\setspn.exe" AND (TO_LOWER(process.command_line) LIKE "* -a *" OR TO_LOWER(process.command_line) LIKE "* -s *")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) user </field>    <field name="CommandLine" type="pcre2">(?i)(/active:yes|/expires:never|/passwordreq:no|/passwordchg:no|/logonpasswordchg:no|/times:all)</field>    <description>Existing account altered to weaken or extend its credentials (1/4)</description>    <mitre>      <id>T1098</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Set-ADAccountPassword|Set-ADAccountControl|Set-LocalUser|Enable-LocalUser|Enable-ADAccount)</field>    <description>Existing account altered to weaken or extend its credentials (2/4)</description>    <mitre>      <id>T1098</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(PasswordNeverExpires|DoesNotRequirePreAuth|AllowReversiblePasswordEncryption)</field>    <field name="CommandLine" type="pcre2">(?i)(Set-ADUser|Set-ADAccountControl|Set-LocalUser)</field>    <description>Existing account altered to weaken or extend its credentials (3/4)</description>    <mitre>      <id>T1098</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\setspn\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)( -a | -s )</field>    <description>Existing account altered to weaken or extend its credentials (4/4)</description>    <mitre>      <id>T1098</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 872128ce-b6a8-43b5-9def-42af76055405

ATT&CKT1098

T1098Account Manipulation

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

AN0265 asks for account attribute changes correlated with unusual process lineage or timing. The correlation half is not expressible here — MITRE's TimeWindow knob wants a five-minute join between a process and a directory change, and SubjectTargetMismatch wants the modifying account compared against the modified one, while lib/sigma has no timeframe, no aggregation and no field-to-field comparison. So the rule takes the process-creation leg alone and stays at the parent technique: command lines that alter an account which already exists in ways that preserve or broaden an adversary's hold on it.

02 · Telemetry you need

process_creation / windows. Sysmon EventID 1 records CommandLine natively. If the site feeds Security EventID 4688 into the same category instead, Audit Process Creation and the separate Include command line in process creation events policy must both be enabled — neither is on by default, or in the MS and CIS baselines — or every term below is blind and the rule looks quiet while it is deaf. Nothing here reads directory events, so 4738/4728 auditing is irrelevant to this rule.

03 · How the logic works

The net.exe/net1.exe leg requires CommandLine|contains: ' user ' and one of six policy-weakening switches — /active:yes, /expires:never, /passwordreq:no, /passwordchg:no, /logonpasswordchg:no, /times:all. Know what that excludes: net user jsmith Summer2026! is two positional arguments with no switch, so the commonest command-line password reset on Windows does not match. This leg detects account-policy weakening, not password setting. selection_cmdlet fires on Set-ADAccountPassword, Set-ADAccountControl, Set-LocalUser, Enable-LocalUser, Enable-ADAccount unconditionally. The paired flag leg exists because PasswordNeverExpires and DoesNotRequirePreAuth are typed far more often in a read than a write — Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} is the canonical AS-REP roasting hunt — so they only count alongside Set-ADUser, Set-ADAccountControl or Set-LocalUser. Unpaired, those two words are T1087 discovery wearing a persistence tag. The SPN leg is \setspn.exe with -a or -s ; note that setspn is an RSAT component and absent from a default workstation, so an attacker without it reaches for Set-ADUser -ServicePrincipalNames, which this rule does not currently see. Group membership changes are excluded on purpose: that is T1098.007.

04 · Common false positives

Identity operations dominate. Password resets and re-enablement are the two most common helpdesk actions anywhere, and joiner-mover-leaver automation does them in bulk on a schedule, so Set-ADAccountPassword and Enable-ADAccount alone can yield hundreds of matches a day from a few admin hosts and IAM connectors. Scripted local-admin rotation calls Set-LocalUser -Password fleet-wide on a fixed cycle. SQL Server, Exchange and SharePoint installs register an SPN with setspn -s and set PasswordNeverExpires on their service account as a documented step. Golden-image scripts run net user Administrator /active:yes.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until it has been run against real data. It has never been executed against a log line.
tier_2: means the account and host exclusions above are actually in place and the level is re-derived from what survives.
tier_3: needs what Sigma cannot give here: the subject-versus-target comparison and the process-to-directory-change join that AN0265 is really describing.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope by host and account before anything else: exclude the identity team's admin workstations, the IAM connector accounts and the rotation tooling, and what remains is account changes from places that have no business making them. MITRE names HighPrivilegeGroupList, TimeWindow and SubjectTargetMismatch; the cmdlet, switch and flag lists in the rule are the pipeline's own. The user gate has a known cost — net.exe user bob with a double space, which cmd tolerates, slips past. Dropping the trailing space closes it.

Declared by the author

Identity operations run from a management host. Password resets and account re-enablement are the two most common helpdesk actions in any organisation, and joiner-mover-leaver automation performs them in bulk on a schedule, so Set-ADAccountPassword and Enable-ADAccount alone can produce dozens to hundreds of matches a day from a handful of admin workstations and IAM connectors. That volume is why this rule is scored low; scope it to accounts and hosts outside the identity team before raising it.
Service-account provisioning during application installs. SQL Server, Exchange, SharePoint and most Kerberos-authenticating products register a service principal name with setspn -s and set PasswordNeverExpires on the account they run as, as a documented and required install step.
Local administrator and break-glass password rotation. Scripted rotation tooling calls Set-LocalUser -Password on every host on a fixed cycle, which matches the cmdlet selection on the entire fleet at once.
Image build and lab provisioning. Golden-image and test-rig scripts commonly run net user Administrator /active:yes or set /expires:never on a local account so that unattended setup can proceed, tripping the net.exe selection on every machine built.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1098, evaluated against their process_creation events.

Share this rule

/u/siemphony/872128ce-b6a8-43b5-9def-42af76055405

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Existing account altered to weaken or extend its credentials

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it