Detection of Renaming Windows Built-in Accounts

Attackers often rename Windows built-in accounts, such as Administrator, Guest, or krbtgt, to evade detection mechanisms that specifically alert on these well-known account names. By changing the account name while retaining the underlying Security Identifier (SID) associated with reserved RIDs (500-504), an attacker can maintain full system privileges and persistence while blending in with legitimate user account naming conventions. This behavior is highly irregular in standard production environments and is often indicative of malicious activity, including persistence establishment, privilege escalation, or attempts to bypass security-information-and-event-management (SIEM) alerts that flag specific, hardcoded account names. Defenders must monitor Windows Security Event ID 4781 to detect these unauthorized modifications, which may also be associated with broader exploitation efforts such as CVE-2026-47301.

Attack Chain

1. Attacker gains administrative access to a Windows host.
2. Attacker enumerates built-in accounts to identify the RID-500 Administrator or other high-privileged targets.
3. Attacker uses the net user command or administrative interfaces to rename the account.
4. The operating system generates Event ID 4781 to record the account name change.
5. Attacker proceeds to perform post-exploitation tasks, such as credential dumping or lateral movement, under the renamed account context.
6. Attacker leverages the modified account to maintain persistent access that evades static account-name-based detection rules.

Impact

Renaming built-in accounts allows attackers to persist undetected in an environment with elevated privileges. This technique can lead to complete host compromise, unauthorized access to sensitive data, and the ability to conduct further malicious actions across the network while circumventing traditional monitoring that triggers on standard names like 'Administrator'.

Recommendation

• Deploy the provided Sigma rule to monitor Windows Security logs for Event ID 4781.
• Implement a process to validate any renaming of built-in accounts against authorized change control windows.
• Investigate any Event ID 4781 that involves accounts with SIDs ending in -500, -501, -502, -503, or -504.
• Patch systems against CVE-2026-47301 if relevant to the environment, as this technique is frequently observed in post-exploitation scenarios following broader system compromise.