NoEscape net.exe admin account password reset (net user admin death)
Detects the use of the 'net.exe' command to reset the password of a local administrator account. This behavior is specifically associated with the NoEscape ransomware, which utilizes this command as part of its impact-oriented activity to prevent authorized access to the compromised system.
Sigma
