Account added to Enterprise Admins group via net.exe
Detects the use of 'net.exe' or 'net1.exe' to add a user to the 'Enterprise Admins' group, which is a highly privileged Active Directory group. This activity is indicative of privilege escalation and persistence attempts by an adversary to gain full control over the domain.
Microsoft Sentinel (KQL)
