A user account was created
A user account was created in Active Directory or the local Security Accounts Manager (SAM).
Event ID 4720 logs the creation of any new user account within Active Directory or local Windows systems. It identifies the Target Account Name alongside the Subject Account (the administrator or service account that created it). It also enumerates the initial attributes assigned during provisioning, such as User Account Control flags, password expiration requirements, and directory paths.
Failure Reason / Root Cause:
Routine administrative onboarding, automated provisioning scripts, or unauthorized persistence establishment by a malicious actor creating a backdoor account.
Raw Event XML snippet
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4720</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-07-17T09:54:44.889Z" />
<EventRecordID>1048576</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="1024" />
<Channel>Security</Channel>
<Computer>DC01.enterprise.internal</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<!-- Event telemetry fields specific to A user account was created -->
</EventData>
</Event>MITRE ATT&CK mapping
| ID | Technique | Tactic |
|---|---|---|
T1136.002 | Create Account: Domain Account | Persistence |
T1136.001 | Create Account: Local Account | Persistence |
Recommended actions
- Verify the Subject Account name against approved IT helpdesk ticketing logs for newly onboarded employees.
- Flag any accounts created outside of standard business hours or by non-administrative user identities.
- Check subsequent events for group membership modifications (such as Event ID 4728 or 4732) assigning high privileges to this new account.