GOLD ENCOUNTER / BQTLock - Local Account Creation Followed by Admin Group Add

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the rapid creation of a new user account followed immediately by that user being added to a high-privilege group (specifically those containing 'administrators' or 'remote desktop users') within a 60-second window. It monitors Windows Security event logs for Event IDs 4720 (User Account Created) and 4732 (Member added to security-enabled local group).