Windows Short Term Account Use
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
YARA-L
