Job-posting scraping burst correlated with rapid new-account creation (fraudulent IT-worker persona tailoring)

Duo Tech@duotech

•updated Jul 9, 2026•1•0•1

This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.