Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Read the full analysis on IntelFusions