Local Account Creation for Persistence via net user or New-LocalUser (T1136.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the creation of local user accounts using administrative tools such as 'net.exe', 'net1.exe', 'powershell.exe', or 'pwsh.exe'. It monitors command-line arguments indicative of account creation (e.g., 'user /add', 'New-LocalUser') and excludes legitimate parent processes commonly associated with administrative activity, such as explorer.exe or services.exe, to reduce noise.