DPRK IT Worker: After-Hours Account Creation Followed by Remote Tool Exec
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Splunk (SPL)
