This rule detects renaming of Windows built-in accounts by monitoring Security Event ID 4781. It identifies changes to built-in accounts by matching the TargetSid against the pattern S-1-5-21-*-50[0-4], which corresponds to well-known Reserved RIDs (500–504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount. The analytic captures the destination host, the old and new target usernames, and the TargetSid, along with the SubjectLogonId. Attackers sometimes rename these accounts to avoid detections that look for literal account names while preserving the privileges associated with the RID (e.g., RID 500). Renaming built-in accounts is uncommon in legitimate operations and is often associated with post-compromise activity or initial system hardening/CIS-compliance steps. The rule provides a Splunk search that ingests Windows event logs (Windows Security log 4781) and surfaces instances where the TargetSid matches the reserved RID pattern. It references MITRE techniques T1078.003 and T1036.010 and recommends validating timing and source of changes against change-control windows to minimize false positives. The detection also includes drilldown guidance and example results for operators to review, such as viewing results by destination, OldTargetUserName, and NewTargetUserName, and assessing associated risk events. Overall, it serves as an endpoint defense evasion alert for unexpected renaming of highly privileged built-in accounts on Windows hosts.