Bulk New Account Creation Volume Anomaly - EventCode 4720/624

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects rapid creation of multiple user accounts within a one-hour window. This behavior can be indicative of malicious activity, such as an attacker creating persistence accounts or staging multiple accounts for lateral movement or automated attacks.