Detection rules › By eventMicrosoft-Windows-Security-Auditing event 47814 detection rules reference this event. View event page.Sigma (1)New or Renamed User Account with '$' Character severity medium T1036 Elastic (1)Potential Privileged Escalation via SamAccountName Spoofing T1036, T1068, T1078, T1078.002, T1098 Splunk (2)Suspicious Computer Account Name Change T1078.002 Suspicious Ticket Granting Ticket Request T1078.002