TrymeLocker Backdoor Account Creation: net user /add + Administrators /add Sequence

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the creation of a local user account followed immediately by the addition of that same account to the local Administrators group using the built-in Windows net.exe or net1.exe utilities. This pattern is commonly observed during adversary post-exploitation activity to establish persistence or escalate privileges.