Created Local User Accounts
Table of all created local user accounts including UserName, ComputerName, aid, aip, and LocalIP.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=UserAccountCreated
| table([@timestamp, UserName, aid, aip, ComputerName, event_platform, LocalIP, name], limit=20000)
| sort(@timestamp)created_local_user_accounts.yml
T1098
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2025-10-30
