{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/security-audit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","privilege-escalation","windows","security-audit","t1136.001"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe creation of local user accounts on Windows systems is a common post-exploitation activity used by adversaries to establish persistence or facilitate lateral movement and privilege escalation. Monitoring for this behavior is essential for security operations centers to identify unauthorized access attempts. This activity is logged via Windows Security Audit event ID 4720. While legitimate administrative actions may trigger this event, such occurrences are often anomalous and should be thoroughly investigated. Defenders should verify new account creation against known administrative change windows. Due to potential noise, organizations may choose to tune the detection logic by excluding Domain Controllers or focusing on high-value, critical infrastructure systems.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique allows an attacker to maintain persistent access to a compromised host, bypass original credential requirements, or escalate privileges within the environment. If left undetected, this can lead to unauthorized access to sensitive systems and data, potentially facilitating further lateral movement throughout the enterprise network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Group Management Audit logs in the Local Windows Security Policy to ensure event ID 4720 is generated.\u003c/li\u003e\n\u003cli\u003eImplement the detection rule provided below to flag new local user account creation in your SIEM.\u003c/li\u003e\n\u003cli\u003eEstablish a workflow to verify all triggered alerts with system administrators to filter out legitimate account provisioning.\u003c/li\u003e\n\u003cli\u003eConsider creating an exclusion list for known service accounts or administrative task automation to reduce false positives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:03:24Z","date_published":"2026-10-12T18:03:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-local-account-creation/","summary":"Detection of unauthorized local user account creation on Windows systems via event ID 4720, a technique frequently leveraged by threat actors for persistence and privilege escalation.","title":"Monitoring Local User Account Creation on Windows","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-local-account-creation/"}],"language":"en","title":"CraftedSignal Threat Feed - Security-Audit","version":"https://jsonfeed.org/version/1.1"}