Net User Domain Account Creation

Barsha Sketh@Barshasketh

•updated Aug 13, 2026•5•0•14

Detects the creation of new domain user accounts using the 'net user /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a Windows domain environment.