Bulk backdoor local admin accounts created via net.exe (rage_master_*)

Subhankar H@Andrewsec57

•updated Jul 6, 2026•1•0•4

Detects the creation of local user accounts using the Windows net.exe utility, specifically looking for accounts containing the 'rage_master_' naming convention, often used by adversaries or automated tools for maintaining persistent access.