Detection rules › By eventMicrosoft-Windows-Security-Auditing event 47208 detection rules reference this event. View event page.Sigma (4)Hidden Local User Creation severity high T1136.001 Local User Creation severity low T1136.001 New or Renamed User Account with '$' Character severity medium T1036 Suspicious Windows ANONYMOUS LOGON Local Account Created severity high T1136.001, T1136.002 Splunk (4)Detect New Local Admin account T1136.001 Short Lived Windows Accounts T1078.003, T1136.001 Windows Create Local Account T1136.001 Windows Increase in User Modification Activity T1098, T1562