// [T1087.001] Account Discovery - Local Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/001/
//
// Identify Windows PR2 events from net that reference local accounts. 

#event_simpleName=ProcessRollup2 
| event_platform=Win ImageFileName=/\(net1?\.exe)/
| CommandLine=/\s+(group|user|localgroup)\s+/
| select([timestamp, aid, UserSid, ParentBaseFileName, ImageFileName, CommandLine])
| sort(field=timestamp, order=asc, limit=10000)
| timestamp := formatTime("%Y-%m-%d %H:%M:%S", field=timestamp, locale=en_US, timezone=Z)