Non-Admin Account Creating Multiple Computer Objects (4741)

Ankit Mehta@Secvyn

•updated 24 days ago•1•0•3

Detects instances where a non-administrative user account creates two or more computer accounts within a 24-hour window. This behavior can be indicative of a compromised account attempting to add rogue machines to the domain for persistence or further lateral movement.