TrymeLocker Backdoor Account Creation via net.exe rage_master_ Accounts

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•5

Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.