Ephemeral Account Created and Deleted Within 24 Hours
Detects instances where a user account is created and subsequently deleted within 24 hours. This behavior may indicate an adversary creating a temporary account for lateral movement, privilege escalation, or establishing persistence that is intended to be short-lived.
Microsoft Sentinel (KQL)
