Hunt for Newly Created Admin Accounts

. Attackers often create rogue administrative accounts post-compromise to establish persistence and achieve privilege escalation.

By ThreatBeaconX Research Team · Updated Sep 2, 2026 · 56 views

hunt-for-newly-created-admin-accounts.spl

index=windows (EventCode=4720 OR EventCode=4732)
| search TargetUserName="*admin*" OR GroupName="*Administrators*"
| table _time, host, SubjectUserName, TargetUserName, GroupName