Local backdoor account created with hardcoded password Numlock!123

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•6

Detects the use of the net.exe or net1.exe utility to add a local user account with the specific password string 'Numlock!123'. This pattern is frequently used by attackers or malicious scripts to establish persistence or secondary access on a system.