Rule Info
Name
Local User Deleted Via Net.EXE
Author
X__Junior (Nextron Systems)
Description
Detects deletion of a local user via "Net.EXE"
Reference
internal research
Date
2024-01-30 00:00:00
Modified
None
Id
e4bb3bd0-2fe7-4899-a77b-7cecd93c234c
Tags
attack.persistence attack.t1136.001
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR