Account disabled, deleted or reset from a command line

Siemphony@siemphonylowT1531unverified

AN0334 asks for user account modification — reset, disable or deletion — correlated with the process lineage that performed it, and this rule takes the process-creation half of that pairing: the shipped tools that carry out the change, each anchored on the flag or verb that makes it destructive rather than a read. The `net.exe` legs require both ` user ` and either `delete` or `active:no` on the same command line, `net1.exe` is listed alongside because `net.exe` hands most subcommands to it, and the cmdlet legs name the local-account and directory forms that disable, remove or reset an account. Three limits worth stating. A cmdlet typed into a PowerShell session that is already running creates no process and is invisible here; the brief's other log source, Security 4723/4724/4740, records the account change itself and would see it, but it is a different logsource and this rule does not use it. The bare `net user <name> <password>` form has no flag to anchor on and is not selected. And Sigma models no aggregation, so a single service-desk reset and a sweep that resets every account in the domain — the LockerGoga behaviour this technique is named for — produce identical single events here, which is why the level sits at the bottom of the scale. MITRE's UserContext, TimeWindow and ParentProcessName knobs all need a baseline or a time window that Sigma cannot express, so none of them is encoded. The brief's process-creation source for this analytic is Sysmon EventID 1; confirm process creation is not filtered out of the running Sysmon config before reading an empty result as quiet rather than blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0120, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " user " and ProcessCommandLine contains "delete")) or ((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " user " and ProcessCommandLine contains "active:no")) or (ProcessCommandLine contains "Remove-LocalUser" or ProcessCommandLine contains "Disable-LocalUser" or ProcessCommandLine contains "Set-LocalUser") or (ProcessCommandLine contains "Remove-ADUser" or ProcessCommandLine contains "Disable-ADAccount" or ProcessCommandLine contains "Set-ADAccountPassword") or (FolderPath endswith "\\wmic.exe" and (ProcessCommandLine contains "useraccount" and ProcessCommandLine contains "disabled=")))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* user *" AND CommandLine="*delete*")) OR ((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* user *" AND CommandLine="*active:no*")) OR (CommandLine="*Remove-LocalUser*" OR CommandLine="*Disable-LocalUser*" OR CommandLine="*Set-LocalUser*") OR (CommandLine="*Remove-ADUser*" OR CommandLine="*Disable-ADAccount*" OR CommandLine="*Set-ADAccountPassword*") OR (Image="*\\wmic.exe" AND (CommandLine="*useraccount*" AND CommandLine="*disabled=*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* user *" AND TO_LOWER(process.command_line) LIKE "*delete*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* user *" AND TO_LOWER(process.command_line) LIKE "*active:no*")) OR (TO_LOWER(process.command_line) LIKE "*remove-localuser*" OR TO_LOWER(process.command_line) LIKE "*disable-localuser*" OR TO_LOWER(process.command_line) LIKE "*set-localuser*") OR (TO_LOWER(process.command_line) LIKE "*remove-aduser*" OR TO_LOWER(process.command_line) LIKE "*disable-adaccount*" OR TO_LOWER(process.command_line) LIKE "*set-adaccountpassword*") OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND (TO_LOWER(process.command_line) LIKE "*useraccount*" AND TO_LOWER(process.command_line) LIKE "*disabled=*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 5 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?: user ))(?=.*(?:delete)).*</field>    <description>Account disabled, deleted or reset from a command line (1/5)</description>    <mitre>      <id>T1531</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?: user ))(?=.*(?:active:no)).*</field>    <description>Account disabled, deleted or reset from a command line (2/5)</description>    <mitre>      <id>T1531</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Remove-LocalUser|Disable-LocalUser|Set-LocalUser)</field>    <description>Account disabled, deleted or reset from a command line (3/5)</description>    <mitre>      <id>T1531</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Remove-ADUser|Disable-ADAccount|Set-ADAccountPassword)</field>    <description>Account disabled, deleted or reset from a command line (4/5)</description>    <mitre>      <id>T1531</id>    </mitre>  </rule>   <rule id="100004" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:useraccount))(?=.*(?:disabled=)).*</field>    <description>Account disabled, deleted or reset from a command line (5/5)</description>    <mitre>      <id>T1531</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: be885340-a516-4e4e-a968-d5bcf0cba502

ATT&CKT1531

T1531Account Access Removal

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

The rule catches the command that disables, deletes or resets a Windows account, not the account change itself. MITRE's AN0334 asks for account modification correlated with the process lineage that performed it; this rule takes the process-creation half of that pairing and anchors each shipped tool on the flag or verb that makes it destructive rather than a read. The behaviour it exists for is the LockerGoga pattern — an operator locking legitimate users out of their own estate to deny recovery.

02 · Telemetry you need

Sysmon EventID 1 process creation from Windows endpoints and, more to the point, from the management servers and domain controllers where account administration actually happens. Every leg depends on CommandLine being present and untruncated, so confirm the running Sysmon config does not filter process creation for the tools named below — an exclusion on net.exe is common in configs tuned for volume, and it turns this rule off without any sign in the output. The brief's other log source for AN0334 is Security 4723/4724/4740, which records the change rather than the command; it is a different logsource and this rule does not use it.

03 · How the logic works

Five selections joined by 1 of selection*. The two net.exe legs both require Image|endswith on \net.exe or \net1.exe — net1.exe is listed because net.exe hands most subcommands to it — plus CommandLine|contains|all on user together with either delete or active:no. The padded spaces around user keep net use and net user apart. The two cmdlet legs match on CommandLine alone, since PowerShell cmdlets are arguments to powershell.exe rather than images: Remove-LocalUser, Disable-LocalUser, Set-LocalUser for the local forms, Remove-ADUser, Disable-ADAccount, Set-ADAccountPassword for the directory forms. The last leg pairs \wmic.exe with useraccount and disabled=. Three limits are worth carrying in your head. A cmdlet typed into an already running PowerShell session creates no process and is invisible here. The bare net user <name> <password> reset form has no flag to anchor on and is not selected. And Sigma models no aggregation, so a single service-desk reset and a sweep across every account in the domain produce identical single events.

04 · Common false positives

Loudly, and from the help desk first. Set-ADAccountPassword and Set-LocalUser are what a password reset is, whether typed by an administrator or run by a self-service portal's worker process — on any estate with a service desk this is the highest-volume match by a wide margin, and it is why the rule is rated low. Behind it: joiner-mover-leaver automation disabling accounts on the leave date and deleting them after retention; build and imaging scripts removing the temporary install account with net user … /delete; and hardening baselines running net user guest /active:no on every host they first touch.

05 · Detection maturity

tier_1: Lowest tier. Derived from MITRE ATT&CK DET0120 and never executed against a single log line — no volume measurement, no confirmed true positive, no evidence the field names survive your pipeline. Baseline it before you alert on it, and re-rate the level from what you observe.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE gives three knobs here — UserContext, TimeWindow and ParentProcessName — and none is encoded, because each needs a baseline or a window Sigma cannot express. That is your tuning work, done in the SIEM around this rule rather than inside it. Exclude the identity-management and service-desk service accounts by name, exclude your provisioning hosts, then suppress inside change windows. ParentProcessName is the one that adds signal rather than removing noise: net.exe under explorer.exe on an admin workstation is routine, the same command under w3wp.exe or a scripting host is not.

Declared by the author

Service-desk password resets, which run as Set-ADAccountPassword or Set-LocalUser from an administrator's shell or a self-service reset portal's worker. On any estate with a help desk this is the highest-volume match by a wide margin, and it is why this rule is rated low rather than higher.
Scheduled joiner-mover-leaver automation that disables an account on the leave date and deletes it after a retention period, using Disable-ADAccount and Remove-ADUser under a known service account on a management server.
Build, imaging and provisioning scripts that remove the temporary install account at the end of a run with net user <name> /delete, which fires once per machine build.
Hardening baselines that disable the built-in guest or local administrator account with net user guest /active:no, firing on every host the baseline is first applied to.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1531, evaluated against their process_creation events.

Share this rule

/u/siemphony/be885340-a516-4e4e-a968-d5bcf0cba502

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Account disabled, deleted or reset from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it