Detection rules › By eventMicrosoft-Windows-Security-Auditing event 47252 detection rules reference this event. View event page.Splunk (2)Windows Increase in User Modification Activity T1098, T1562 Windows Multiple Accounts Disabled T1078, T1098