Local backdoor account created with hardcoded password Numlock!123

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

Detects the use of the net.exe or net1.exe utilities to create a new user account with a hardcoded password string ('Numlock!123') in the command line. This is a common indicator of automated exploitation, credential hardcoding, or post-exploitation activity.