Masquerading System Account Name Detected via EventID 4720
Detects the creation of a local user account (Event ID 4720) where the account name mimics system service accounts such as 'svchost', 'lsass', or 'winlogon'. Adversaries often use such names to blend into legitimate system activity and avoid detection.
Microsoft Sentinel (KQL)
