New Local Account Created or Added to Administrators Group
This rule detects the creation of new local user accounts or the addition of existing accounts to the local Administrators group on Windows systems. It specifically looks for Windows Security Event IDs 4720 (A user account was created) and 4732 (A member was added to a security-enabled local group) or 4728 (A member was added to a security-enabled global group) or 4756 (A member was added to a security-enabled universal group), filtering for 'User' account types and ensuring that for Event ID 4732, the group is the 'Administrators' group (identified by SID S-1-5-32-544 or group name). This activity can indicate an adversary establishing persistence or escalating privileges.
Microsoft Sentinel (KQL)
