Ransomware Series: Edge Device Admin Access Followed by Rapid Local Admin Account Creation

Ibrahim Saud@tektrix

•updated Sep 25, 2026•5•0•7

This rule detects potential unauthorized account creation by correlating suspicious administrative activity on network edge devices (VPNs, firewalls) with subsequent local administrator account creation on an internal host within a one-hour window. This behavior is indicative of ransomware affiliates exploiting internet-facing infrastructure to gain initial access and escalate privileges.