4720 Security log · Account Management high severity low volume

Windows Event ID 4720 — A user account was created

A new user account was created. SubjectUserName=creator, TargetUserName=new account.

Why event 4720 matters

Persistence via account creation (T1136). Patterns: names mimicking admins, creation outside business hours, immediate group membership (4728/4732 within 60 s). Tools: net user /add, New-ADUser, New-LocalUser.

How to detect it

Alert: creation outside business hours. Alert: creator is non-IT account. Correlate with 4728 (added to privileged group) within 60 s. Monitor created→enabled→logon chain.

Log source
Security
Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Fields to pivot on
TargetUserNameSubjectUserNameSamAccountNameDisplayName

MITRE ATT&CK mapping

Tactic Technique
Persistence Create Account: Local Account (T1136.001)
Persistence Create Account: Domain Account (T1136.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: User Account Created
status: stable
description: Detects new user account creation
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
falsepositives:
    - Legitimate IT provisioning
level: medium
tags:
    - attack.persistence
    - attack.t1136.001
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4720   // A user account was created
| project TimeGenerated, Computer, TargetUserName, SubjectUserName, SamAccountName, DisplayName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4720
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A user account was created — add EventData fields: TargetUserName, SubjectUserName, SamAccountName, DisplayName`
Hunt event 4720 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Account Management events

4722 A user account was enabled 4723 An attempt was made to change an account's password 4724 An attempt was made to reset an account's password 4725 A user account was disabled 4726 A user account was deleted 4728 A member was added to a security-enabled global group 4729 A member was removed from a security-enabled global group 4730 A security-enabled global group was deleted 4731 A security-enabled local group was created 4732 A member was added to a security-enabled local group 4733 A member was removed from a security-enabled local group 4734 A security-enabled local group was deleted

Frequently asked questions

What is Windows Event ID 4720?

A user account was created. A new user account was created. SubjectUserName=creator, TargetUserName=new account.

Which log records event 4720?

Event 4720 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4720?

Event 4720 is associated with: Create Account: Local Account (T1136.001), Create Account: Domain Account (T1136.002).

How do you detect activity around event 4720?

Alert: creation outside business hours. Alert: creator is non-IT account. Correlate with 4728 (added to privileged group) within 60 s. Monitor created→enabled→logon chain.