UAT-8099 Hidden Persistence Account Creation
Detects the creation of hidden local user accounts (`admin$`, `mysql$`, `mssql$`, `admin1$`, `admin2$`, `power$`) using `net.exe` or `net1.exe` as used by the threat actor UAT-8099 for persistence on compromised IIS servers. The rule also broadly detects any account creation ending with a '$' symbol, which often indicates a hidden account.
Sigma
