QEMU attack chain: local account creation followed by offensive tooling within 1h

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•2

This rule detects a sequence of events where a new local account is created on a device using common administrative commands (net user, PowerShell New-LocalUser), followed within 60 minutes by the execution of known offensive security tools or frameworks such as Impacket, NetExec, CrackMapExec, Chisel, or Havoc agent on the same device. This pattern is indicative of potential unauthorized system access, staging of persistence mechanisms, or active reconnaissance activities.