Akira Pre-Deployment: Domain Admin Account Creation via net.exe Across Multiple Hosts

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects the suspicious creation or modification of high-privileged accounts (Domain Admins, Enterprise Admins, Administrators) using net.exe or net1.exe. It triggers when these commands are executed via PowerShell or cmd.exe, originating from suspect parent processes (WmiPrvSE.exe, mstsc.exe, etc.), and specifically monitors for a pattern of creating the same new account across multiple distinct hosts within a short 30-minute window, excluding accounts that existed in the prior 24-hour baseline.