Domain account creation via net.exe with admin-like naming (backup_DA/backup_EA)

Emiliano Mema@Nosalva

•updated Aug 18, 2026•2•0•6

Detects the creation of domain user accounts using the native 'net.exe' or 'net1.exe' utilities with command-line arguments that include '/add', '/dom', and naming conventions indicating 'backup_DA' or 'backup_EA'. This pattern is often associated with adversary attempts to establish persistence or backdoors using privileged service-like account names.