High Volume Account Changes
This rule detects a high volume of account changes (creation or modification) within a one-hour window by a single user. Specifically, it looks for 10 or more instances of EventID 4720 (A user account was created) or EventID 4722 (A user account was enabled) originating from the same SubjectUserName within an hour.
Microsoft Sentinel (KQL)
