Account Lockout via Net User

wakasa smoky@wakasadb3

•updated Apr 28, 2026•3•0•262

Detects the specific usage of the 'net.exe' or 'net1.exe' command to lock out user accounts by setting them to inactive and restricting login times. This behavior was observed in the Lotus Wiper destructive campaign to prevent remediation before wiping the system.