Hidden Local Account Creation via net user

Thiru N@Iamthiru

•updated Apr 24, 2026•1•0•141

Detects the creation of hidden local accounts using the 'net user' command where the username ends with a '$' symbol. This technique is used by the Andariel group for RID hijacking attacks to maintain stealthy persistence.