User Account Creation or Deletion Activity

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•3

This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.