Local Account Creation via net.exe or net1.exe (T1136.001)
Detects the creation of a new local user account on a Windows system using the net.exe or net1.exe command-line utilities. This is a common technique used by attackers for establishing persistent access to a compromised system.
SentinelOne
