Prinz Eugen ROOTBOY: net.exe creates local account 'admin germania'

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

Detects the use of 'net.exe' to create or modify user accounts, specifically looking for commands that include 'user', 'admin', and '/add'. This could indicate an adversary establishing persistence or escalating privileges by creating new administrative accounts.