Akira/BumbleBee: net.exe Domain Admin Account Creation or Activation via PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.