UAT8099 Suspicious Account Creation And RDP Enablement

Tim Peck@timpeck

•updated Oct 2, 2025•1•2•125

Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.