Windows Multiple User Account Creations

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•8•0•6

Detects five or more distinct Windows user-account creation events (Event ID 4720) associated with the same actor and host within a one-hour time bucket, which may indicate unauthorized account creation for persistence or mass provisioning.