How can a new user account provide persistence?¶
A new account can provide an additional access route that remains after the original session or credential is lost. Account creation is also routine, so malicious purpose must be established from origin, authority and use.
Trace creation into authentication¶
Preserve the stable account identifier, creation time, creating account or process, roles, groups, authentication methods and recovery details. Display names can imitate employees, administrators or services and are less reliable than platform identifiers.
Then examine first and later sign-ins, source devices, privilege changes and actions. Account presence proves neither a successful login nor later misuse. A compromised account may create the new identity, while another person or automated process uses it.
Check every relevant identity layer - local device, directory, cloud tenant and application - because similar names may represent distinct accounts.
Look for concealment without assuming it¶
Hidden listings, monitoring exclusions and misleading descriptions may support deliberate concealment. Compare them with legitimate provisioning and service-account practices before concluding intent.
Containment may delete the strongest record. Export the account, role, authentication and audit history before disabling or removal where risk permits, and record the response time so later absence is explained.
Key takeaway
Establish who or what created the account, which access it received and whether it was used; creation alone is not proof of malicious persistence.
