NoEscape wmic rename of local admin account to 'NO ESCAPE'

Subhankar H@Andrewsec57

•updated Jul 20, 2026•0•0•0

Detects the use of WMIC to rename a local administrator account to 'NO ESCAPE'. This behavior is associated with the NoEscape ransomware, which renames the built-in administrator account to 'NO ESCAPE' as part of its post-compromise activity.