Local Account Creation and Privilege Escalation via Net.exe (Amadey Malware)

Kaung Khant Ko@kaungkhantko

•updated Jul 2, 2026•32•0•39

Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.