Local Admin Account Creation + Privilege Assignment via net.exe (T1136.001/T1078.003)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects the creation of a new local account using the 'net' utility, followed immediately by that account being added to the local administrators group on the same endpoint. This behavior is a common indicator of persistence or privilege escalation attempts.