BQTLock/GOLD ENCOUNTER Local Account Creation via net.exe or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects the creation of a local user account (EventID 4720) or the addition of a user to sensitive local groups such as Administrators or Remote Desktop Users (EventID 4732). This behavior is common in persistence mechanisms used by threat actors such as BQTLock ransomware and GOLD ENCOUNTER.