• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    User account created and deleted within 10 mins

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•4•0•37

    'Identifies when a user account is created and then deleted within 10 minutes. This can be an indication of compromise and an adversary attempting to hide in the noise.'

    Microsoft Sentinel (KQL)

    Tags

    T1098 - Account ManipulationT1078 - Valid AccountsTA0003 - PersistenceTA0004 - Privilege EscalationTA0005 - Defense EvasionTA0001 - Initial AccessT1136 - Create AccountT1531 - Account Access RemovalTA0040 - ImpactT1136.001 - Local AccountUser Account CreatedUser Account DeletedAuthentication AttemptLogon EventAdmin ActivityWindowsWindows Eventlog Securitykqltactic:Persistencetactic:PrivilegeEscalationtechnique:T1098technique:T1078

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?