Detection of Windows Guest Account Activation via Net.exe

The Windows guest account is a default, built-in account designed with heavily restricted permissions and limited system access. By default, this account is disabled on all Windows operating systems. Adversaries often target this account to maintain persistent, low-profile access, bypass standard user auditing, or facilitate lateral movement. Enabling this account allows an attacker to return to a compromised host using a legitimate, pre-existing local account, which may circumvent security controls that monitor for the creation of new, anomalous user accounts. The activation is typically performed by running the Windows utility 'net.exe' with specific administrative parameters. Defenders should monitor for these command-line executions to identify unauthorized privilege escalation or persistence activities within their environment.

Impact

Successful activation and exploitation of the guest account can provide attackers with a foothold to perform malicious activities, including malware installation, file system manipulation, sensitive data exfiltration, or further system control. This technique is particularly concerning in environments where the guest account is not routinely managed or audited, as it provides a stealthy mechanism for maintaining long-term access.

Recommendation

Detection engineering teams should monitor process creation events for the execution of net.exe with arguments intended to modify user account status.

• Deploy the Sigma rule in this brief to identify potential unauthorized activation of the guest account.
• Enable Sysmon or Windows Security Event ID 4688 to capture complete process command-line telemetry.
• Establish an allowlist for known administrative or automated maintenance accounts authorized to manage local user accounts to reduce noise in security alerts.