ROOTBOY net.exe local admin account creation with password 'germania'

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects the creation of a local user account named 'admin' with the password 'germania' using the native 'net.exe' utility. This specific command pattern has been associated with pre-ransomware activity during the 'Prinz Eugen' campaign to establish persistence and unauthorized administrative access.