Nightmare Eclipse - Rogue Local Administrator Creation (T1136.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•4

Detects the creation of a new local user account followed by its immediate addition to the local Administrators group, indicative of potential privilege escalation or persistence by an attacker.