[WINDOWS-SECURITY] User Created with Net User Command

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] User Created with Net User Command"; program:*Security*
| *Sysmon*; event_id:1,4688; content:"net user"; nocase; content:"/add"; nocase; reference:url,https://infosecwriteups.com/common-tools-techniques-used-by-threat-actors-and-malware-part-i-deb05b664879; classtype:trojan-activity; sid:5014330; rev:1; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2024_02_28, updated_at 2024_02_28, mitre_tactic_id TA0007, mitre_technique_id T1087.001;)