Detection of Local Administrator Account Creation via Net.exe

This detection analytic identifies the creation of a local administrator account on Windows systems by monitoring the usage of 'net.exe' with the '/add' parameter in conjunction with administrator-related group names. This activity is a common indicator of attackers attempting to establish persistence or escalate privileges on a compromised host. Multiple threat actors and malware families, including Medusa Ransomware, Azorult, DarkGate, and Lapsus$ affiliates, utilize this technique to maintain access post-exploitation. Detection engineers should look for process execution patterns involving net.exe that match this command line syntax, while accounting for legitimate administrative tasks.

Impact

Successful execution of this technique allows an adversary to maintain long-term access to a system, bypass security controls, and perform further lateral movement or data exfiltration. If confirmed malicious, this activity often represents a late stage in the kill chain where an attacker has already obtained high-privileged credentials or found a path to execute system commands.

Recommendation

• Deploy the Sigma rule below to monitor for local group modification commands.
• Enable Sysmon Event ID 1 (Process Creation) and ensure command-line arguments are captured in logs.
• Use the Splunk Common Information Model (CIM) to map process execution data to the Endpoint data model.
• Prioritize alerts where the parent process is a non-standard utility or a web-server-related process, indicating potential remote code execution exploitation.