Local Account Creation for Backdoor Access - QEMU/BQTLock Campaign

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule monitors for suspicious administrative activity on Windows systems, specifically detecting the creation of new local user accounts (excluding machine accounts) and the addition of users to the local Administrators group.