Event ID 4720 shows a new user account was created, which may be legitimate onboarding or attacker-established persistence. Focus on the account name, group membership, SID history and delegation settings, because attackers often create accounts that look ordinary or inherit excessive privilege. Correlate the event with change tickets, admin activity and subsequent logons.
What Event ID 4720 Usually Means in an Attack Chain
Event ID 4720 is about account creation, so the security question is not just “was a user added?” but “who created it, why, and what did that new account gain access to?” In real investigations, this event often sits at the boundary between normal administration and attacker persistence. The useful clue is whether the account was created in a way that matches expected change activity or whether it looks designed for stealth and later use.
When 4720 matters operationally, the first thing to resolve is whether the account is a fresh identity with legitimate business purpose or an implant for follow-on access. A new account can be abused immediately, but it can also be staged and left idle until later. That makes surrounding telemetry important, especially the creating principal, the host used for creation, and whether the account later participates in logon, privilege escalation or remote administration.
The account attributes themselves often reveal intent. A suspicious 4720 event may involve an ordinary-looking name, a disabled display name mismatch, unusual group membership, SID history, delegated rights or properties that make the account blend into standard administration. Those details can be more informative than the creation event alone because attackers frequently try to create an account that survives basic review and looks like an authorized helpdesk or service identity.
Use the event as a pivot into nearby identity and authorization evidence. Correlate it with change tickets, admin workstation activity, directory service changes, password resets and subsequent authentication events. If the new account is followed by privileged group changes or access to sensitive systems, the event is no longer just onboarding noise, it becomes a potential persistence or privilege establishment path.
What to Check When a New Account Appears Unexpectedly
Check whether the creator is a known administrator, a provisioning system, or an unexpected interactive session. A 4720 event created from an unusual source, outside the normal provisioning path, or near unusual logon activity deserves closer review. Also verify whether the account naming pattern matches local policy, because attacker-created accounts often resemble legitimate service or support identities closely enough to avoid immediate notice.
Review the security context around the new account, not only the event itself. The presence of delegated permissions, privileged group membership, SID history or rapid follow-on rights assignment changes the meaning of the creation event. If the new account can later be used to authenticate broadly, it may become a durable backdoor even if the original compromise point is removed.
Where account creation is legitimate, the evidence should line up cleanly: approved request, expected creator, expected naming convention, documented group assignment, and a reasonable sequence into first use. Where that chain breaks, treat the account as suspicious until proven otherwise. That is especially true when the account was created outside business hours, from an admin endpoint that does not usually perform provisioning, or in conjunction with other directory changes.
For background on the surrounding Windows event IDs and how they fit together, see the Windows Event Log Guide. For broader attacker patterns that include credentialed persistence, account abuse and follow-on access, review The State of NHI & AI Agent Breach Report 2026.
How Attackers Use New Accounts for Persistence and Blending
New accounts are attractive because they can survive password changes, session resets and the cleanup of the original entry point. An attacker may create a low-profile account to keep access after they lose a stolen password, or to separate maintenance activity from their primary compromise path. In some environments, a newly created account is also used to test whether monitoring catches identity lifecycle events at all.
Another common abuse pattern is privilege shaping. The account is created first, then quietly moved into groups or delegated permissions that seem routine at a glance. If those changes are not reviewed together, the account can end up with enough access to perform lateral movement, access data or administer systems without appearing obviously malicious. That is why 4720 should always be interpreted alongside subsequent directory events and first-use logons.
Detection improves when you compare the event to the wider identity picture. A new account that never logs in may still be a dormant foothold, while one that immediately authenticates from a workstation, server or remote session often indicates active operator use. Correlating 4720 with logon activity also helps separate legitimate provisioning from an account created for use in a specific operation, especially when the timing is tight.
If you need to validate the surrounding Windows telemetry or build better correlation rules, the Sysmon Guide is useful for complementary host-side visibility. For log review and follow-on investigation of script-based abuse after account creation, the PowerShell Security Guide can help connect identity events to execution activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1136 — Create Account | Account creation is the core persistence and access-establishment pattern here. |
| Recommendation — Map unexpected 4720 events to Create Account and hunt for follow-on privilege or logon activity. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | 4720 investigation depends on correlating directory and logon evidence. |
| AC-2 — Account Management | The event reflects account lifecycle governance and review of account attributes. | |
| Recommendation — Review 4720 in correlated audit data to distinguish approved provisioning from abuse. Validate new account purpose, ownership, and privilege assignment under account management controls. | ||
| CIS Controls v8 | CIS-5 — Account Management | Unexpected account creation is an account management and review problem. |
| Recommendation — Inventory new accounts, verify approvals, and remove unauthorized identities quickly. | ||
| NIST CSF 2.0 | DE.CM-02 — Monitoring for Unauthorized Activities | Detecting suspicious account creation requires continuous monitoring of identity events. |
| Recommendation — Alert on unusual account creation patterns and investigate them as potential unauthorized activity. | ||
Practitioner Guidance
What to verify: Treat 4720 as a change-control question first, not only a security alert. Verify the creator, the source host, the ticket or approval, and whether the new account’s groups and delegation settings match the stated business purpose.
Decision rule: If the account has any unexpected privilege, unusual naming, or no defensible provisioning trail, prioritize containment around the account itself before assuming the creation was benign. If the account is later used for interactive logon or remote administration, elevate the review to a likely persistence path.
Practitioner takeaway: The value of Event ID 4720 is not the creation event alone, it is the speed with which you can prove whether the account is ordinary provisioning or an access foothold that was built to blend in.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org