This script was dropped and run in the honeypot recently. Here are a couple takeaways and a screenshot of the script.
- @iranofficall / User Creator
- Adds 4 users
- Sets passwords to $95But6nL03
- Sets passwords to never expire
- Enables RDP
- Hides accounts from sign-in screen
Possible Detections
- Command arguments contains /maxpwage:unlimited
- Process net.exe + command arguments user /add + $95But6nL03
- Command arguments contains Winlogon\SpecialAccounts\UserList
Share this:
-
-
Click to share on LinkedIn (Opens in new window)
-
Click to share on Reddit (Opens in new window)
-
More
-
-
Click to email this to a friend (Opens in new window)
-
Click to share on Tumblr (Opens in new window)
-
-
Click to share on Pinterest (Opens in new window)
-
Click to share on Pocket (Opens in new window)
-
-
Click to share on Telegram (Opens in new window)
-
Click to share on WhatsApp (Opens in new window)
-
-
Click to share on Skype (Opens in new window)
-
Related