Amadey/StealC Local Account Creation via net user or New-LocalUser

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of new local user accounts by monitoring for the 'net user /add' command or the 'New-LocalUser' PowerShell cmdlet. This activity is commonly used by malware, such as Amadey and StealC, to establish persistence on a compromised system.