Suspicious Domain Account Creation Beyondtrust

nomit vyas@xoxo

•updated Feb 23, 2026•2•0•40

Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.