Safe: Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}} — ReflexSec

Safe

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}}

windows · powershell · Nightmare

Pulls account-creation events out of the Security log and projects the new account name into a column. The calculated property runs against…

The full explanation and danger signals for this pack are part of Pro.

Think you can spot these under time pressure?

More Credential Access