1 rule found for "Jack Croock (method)"
Detects activity as "net user administrator /domain" and "net group domain admins /domain"