Storm-1175 - Local Admin Account Creation (T1136.001)
Detects the threat actor executing net user /add and adding the account to the local Administrators group to maintain interactive access via RDP.
Microsoft Sentinel (KQL)
Detects the threat actor executing net user /add and adding the account to the local Administrators group to maintain interactive access via RDP.
Already have an account?