DarkGate - Local User Creation via Net.exe
Detects the creation of a local user account named "DarkGate" with the username "SafeMode" using the `net.exe` or `net1.exe` command-line utility. This specific pattern is associated with DarkGate malware activity.
Sigma
