Question

During an investigation of a compromised Windows domain controller, an analyst reviews the Security event log and finds an Event ID 4720 recorded at 03:14 AM, immediately followed by an Event ID 4728. The 4720 event references a new account named 'svc_backup2'. What activity does this sequence most likely indicate?

Accepted Answer

A new user account was created and then added to a security group

Answer

A user successfully logged on interactively during off-hours

Answer

A scheduled service failed to start and was restarted automatically

Answer

An existing account's password was reset by an administrator