Ransom Busters Backdoor Account Creation with Password Numlock!123

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

Detects the creation of a local user account using the hardcoded 'Numlock!123' password, a characteristic artifact associated with Ransom Busters threat group operations. The rule monitors command-line activity from net.exe or net1.exe to identify attempts to add users with this specific, known malicious credential.