Account Creation or Group Modification via Command Line
Detects the use of common command-line utilities (net, powershell, cmd) to perform user account creation or local group membership modification, which are behaviors often associated with adversary persistence or privilege escalation.
Microsoft Sentinel (KQL)
