# An administrator account appeared that nobody remembers creating. What now?

Treat it as an incident until you have an explanation. New administrator accounts are a common way for attackers to keep access, and they are often named to look ordinary, such as a variant of a service or support account. Do not delete it straight away: disable it, note its name, its creation time and who or what created it, and save the directory and system logs that show this before they are overwritten. Then ask the obvious people, such as your IT provider or a software vendor, whether they created it. If nobody did, look for what else changed at the same time, reset the passwords of the other administrators from a clean device and call your incident-response provider. The account itself is identity evidence that a network sensor does not see; NetSenX shows whether hosts used around that time began scanning or opening new sessions to servers.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [A server sends data out at night. What should we check?](https://netsenx.com/en/faq/a-server-sends-data-out-at-night-what-to-check)
- [Our public IP address is on a blocklist. Does that mean we have been hacked?](https://netsenx.com/en/faq/our-ip-address-is-on-a-blocklist-are-we-hacked)
- [A colleague says the mouse moved by itself. Is someone controlling the computer?](https://netsenx.com/en/faq/the-mouse-moved-by-itself-is-someone-controlling-the-computer)
- [How do we check a suspicious computer without tipping off the attacker?](https://netsenx.com/en/faq/how-to-check-a-suspicious-computer-without-alerting-the-attacker)
- [How do I know if my business network has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-my-business-network-has-been-compromised)