Detecting bat script via GPO net user <usuario> <passwd>?

Good day,

I appreciate knowing how to generate a detection rule to identify if the network is using scripts (bats) with passwords:

Example a bat that is downloaded to stations and servers via GPO with command:
net user username password

thanks,
Sergio