An unauthorized user account was created in the Active Directory to maintain persistent access to the network. The account creation was detected, indicating a potential persistence technique being employed by attackers.