Multiple Account Creations or Enables by a Single User

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.