New Local User Created Via Net.EXE
Detects the creation of new local user accounts using the 'net.exe' or 'net1.exe' command-line utility with the 'user add' arguments. This activity can be indicative of an adversary establishing persistence or creating accounts for lateral movement.
Sigma
