User Account Control 'Not Delegated' Flag Modified

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•5

Detects when a user account's 'UserAccountControl' attribute is modified to include the 'Not Delegated' flag (EventID 4738). This change can be an indicator of an attacker attempting to alter account behavior for persistence or to evade detection, or it could be a legitimate administrative action.