Rapid Privileged Domain Account Creation via Net Command

Ethan Andrews@eandrews

•updated Feb 16, 2026•9•0•97

Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.