Ephemeral Account Created and Deleted Within 4 Hours (MinutesActive <= 240)
This rule detects the creation and subsequent deletion of a local user account within a 240-minute window. This behavior is often indicative of an adversary creating a temporary, ephemeral account for malicious activity (e.g., persistence or lateral movement) and then removing it to evade detection or cover their tracks.
Microsoft Sentinel (KQL)
