Susp Script Hiddenaccount Adminrdp Creation
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
YARA
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
Already have an account?