Tag
Detection of unauthorized local user account creation on Windows systems via event ID 4720, a technique frequently leveraged by threat actors for persistence and privilege escalation.