Disabled guest or builtin account activated (command)

Detects scenarios where an attacker enables a disabled builtin account via command line.