Local User Account Creation via net.exe (T1136.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•6

Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.