Local User Creation and Addition to Administrators Group

Ankit Mehta@Secvyn

•updated Jun 30, 2026•3•0•6

This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.