Open the studio.

A composition from the corpus

Local account created from a command line

logsource:  category: process_creation  product: windowsdetection:  selection_net_binary:    Image|endswith:      - '\net.exe'      - '\net1.exe'  selection_net_user_verb:    CommandLine|contains: ' user '  selection_net_add_switch:    CommandLine|contains:      - ' /add'      - ' -add'

T1136.001
persistence
verified

This one is verified — it fired on a real recording of the attack it claims to detect. Most rules here are not, and say so plainly: the badge is earned against real telemetry, not granted, and you can run any rule against the same recordings yourself, in your browser.