Ransom Busters Backdoor Account Creation with Password Numlock!123

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

This rule detects the creation of a local user account using the 'net.exe' or 'net1.exe' utility where the command line contains a specific hardcoded password ('Numlock!123'). This pattern is indicative of automated or manual post-exploitation activities, such as creating a back-door account for persistent access.