Unauthorized account creation is a classic indicator of a persistent threat or insider risk.
Netwrix provides pre-built report templates for major regulations. netwrix auditor