Akira Domain Admin Account Provisioning via net.exe Pre-Ransomware

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects the use of net.exe or net1.exe to create domain accounts or grant them administrative privileges (Domain Admins or Enterprise Admins) in Active Directory. This behavior is indicative of pre-ransomware persistence techniques employed by the Akira threat group, where attackers create specific service accounts and elevate their privileges before ransomware deployment.