Local user account creation by a machine account

Cortex XDR Analytics Alert Reference by Alert name

Product: Cortex XDR
Last date published: 2026-02-02
Category: Analytics Alert Reference
Index by: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Valid Accounts: Local Accounts (T1078.003)
Severity	Informational

Description

A machine account was observed creating a rare local user account.

Attacker's Goals

Persistence using a valid account.

Investigative actions

Check the machine that created the user account and verify its activity.
Check if the machine account is supposed to create user accounts.
Investigate whether the same account was created on different hosts as part of an installation process.