Detection of Rapid Creation and Deletion of Windows Accounts

Attackers frequently abuse the capability to create and remove user accounts to facilitate malicious operations, such as privilege escalation, lateral movement, or maintaining temporary persistence. By performing these actions in rapid succession, actors aim to minimize their footprint and evade security monitoring that focuses on long-term account activity. This analytic specifically tracks the creation (Event ID 4720) and subsequent deletion (Event ID 4726) of local or domain user accounts within a 60-minute window. This behavior is highly characteristic of automated scripts or manual administrative abuse where an adversary creates a backdoor account, performs a secondary action, and then removes the account to leave no trace. Defenders should investigate these events to differentiate between authorized administrative cleanup and malicious account lifecycle manipulation.

Attack Chain

1. Attacker gains initial access to a Windows host or domain controller.
2. Attacker executes net user /add or invokes the API to create a new local or domain account.
3. Security event 4720 (User account created) is generated in the Windows Security log.
4. Attacker leverages the new account to conduct unauthorized activities (e.g., file access, lateral movement).
5. Attacker executes net user /delete or invokes the API to remove the account.
6. Security event 4726 (User account deleted) is generated in the Windows Security log.
7. Attacker objective (e.g., exfiltration, persistence) is achieved or abandoned.

Impact

Successful exploitation of ephemeral account creation allows attackers to bypass security monitoring designed for persistent accounts. This technique is often associated with unauthorized access, privilege escalation, and lateral movement. Failure to detect this activity can result in persistent threats remaining undetected within the network, as the evidence of the account existence is removed shortly after use.

Recommendation

Prioritized actions for detection and investigation teams:

• Deploy the logic monitoring for Event IDs 4720 followed by 4726 within a 60-minute interval on all critical endpoints and domain controllers.
• Enable Group Management Audit Logs in the Local Windows Security Policy to ensure these events are generated and captured by the SIEM.
• Investigate every instance of short-lived account creation, correlating the event with the source user (src_user) and the account created (user) to determine if the activity aligns with documented administrative tasks.
• Adjust the maxspan and time window parameters to account for specific environment baseline activity.