I have Windows Server 2019. it is a database server(MSSQL Server) in the intranet environment. I monitor Its Process and I found sometimes the below process runs automatically without any cause.
"C:\Windows\system32\cmd.exe" /c "net localgroup administrators" "net localgroup administrators"
I check my user's list and group list and I don't see any new users. I don't know why net.exe runs with this command to create new local admin accounts. how could I check its root cause and is there any solutions to find the net.exe activity log?