Net.exe Account Enumeration
Detects repeated execution of 'net.exe' with commands related to user or group enumeration (e.g., 'net user', 'net localgroup', 'net group') without adding accounts. This behavior can indicate an adversary performing account discovery on a system or within a domain.
Microsoft Sentinel (KQL)
