BQTLock/GOLD ENCOUNTER Local Account Creation for Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule monitors for new user account creation (Event ID 4720) that is either performed by a known suspicious process name or initiated by a non-standard provisioning account. It additionally correlates these creation events with subsequent additions of the new account to the local Administrators group (Event ID 4732) to flag potential privilege escalation attempts.