Account renamed to admin (or likely) account to evade defense

Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance