Domain account creation followed by privileged group add via CLI or PowerShell

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•4

Detects a sequence where a domain user account is created (via net.exe or New-ADUser) and the same account is subsequently added to privileged groups such as Domain Admins or Enterprise Admins within one hour.