TrymeLocker rage_master_ backdoor account creation via net user /add
This rule detects the creation of new user accounts via the Windows 'net user' command or Windows Security Event 4720 where the account name or command line arguments contain the string 'rage_master_'. This pattern suggests the potential creation of an unauthorized or backdoor account, possibly related to a specific naming convention used by an actor or a naming collision with malicious activity.
Splunk (SPL)
