# Event correlation rule for new user creation **URL:** \ **Category:** Elastic Agent\ **Tags:** elastic-stack-security\ **Created:** [September 5, 2022, 1:39pm UTC](https://discuss.elastic.co/t/event-correlation-rule-for-new-user-creation/313690 "2022-09-05T13:39:26Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![realtech2338](https://avatars.discourse-cdn.com/v4/letter/r/76d3ee/32.png) [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Post date:** [September 5, 2022, 1:39pm UTC](https://discuss.elastic.co/t/event-correlation-rule-for-new-user-creation/313690/1 "2022-09-05T13:39:26Z")
Hi Team, I am trying create a new correlation rule for a series of evenid's . I have replicated the scenario in my lab. When a threat actor creates a new account by copying existing admin account and assiging new name etc.. we should get alert. Here is the eql query I have written: sequence by organization.id, user.target.id with maxspan=5m [any where event.type == "4724"] [any where event.type == "4738"] [any where event.type == "4722"] [any where event.type == "4720"] or even sequence by organization.id, user.target.id with maxspan=5m [any where event.action == "An attempt was made to reset an account's password"] [any where event.action == "A user account was changed"] [any where event.action == "A user account was enabled"] until [any where event.action == "A user account was created"] I dont see any alerts coming even though I have generated traffic. KIndly suggest if I need to correct something. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 3, 2022, 1:39pm UTC](https://discuss.elastic.co/t/event-correlation-rule-for-new-user-creation/313690/2 "2022-10-03T13:39:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.