Skip to content
Threat Feed
Subscribe

Tag

Security-Audit

1 brief RSS
medium advisory

Monitoring Local User Account Creation on Windows

Detection of unauthorized local user account creation on Windows systems via event ID 4720, a technique frequently leveraged by threat actors for persistence and privilege escalation.

persistence privilege-escalation windows security-audit t1136.001
1r 1t