New User Created Via Net.EXE
Identifies the creation of local users via the net.exe command. This rule specifically looks for process creation events where 'net.exe' or 'net1.exe' is executed with the 'user' and 'add' arguments in the command line.
YARA-L
