Machine Account Creation via Default MAQ Abuse (Event 4741)
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.
Microsoft Sentinel (KQL)
