Built-in Administrator password reset and reactivation via net.exe

Emiliano Mema@Nosalva

•updated Aug 18, 2026•1•0•5

Detects the use of net.exe or net1.exe to interact with administrator accounts, specifically looking for attempts to hardcode passwords in the command line or enabling/modifying domain accounts. This is a common pattern for local account persistence, privilege escalation, or lateral movement.