Description
This generic detection identifies attempts to create unauthorized user accounts on infected systems, a persistence technique cyberattackers use to maintain access.
Stats
- First seen
- May 2022
- Last seen
- September 2026
Alert name variants
| Alert Name |
|---|
| Application.HackTool.AddUser.A |
| BAT.AddUser.A |
| Script-PHP.Trojan.AddUser |
| Text.Trojan.AddUser |
| Win32.Trojan.AddUser |
| Win64.Trojan.AddUser |