New User Creation Monitoring For On-Prem

Goksel Atakan@gokselatakan

•updated Aug 10, 2026•3•1•7

This rule detects the creation of a new user account in Active Directory by monitoring for Windows Security Event ID 4720. It extracts the target username, target domain, and the user who performed the account creation to provide context for investigation.