A service account named svc_dbbackup runs automated database backups but has no interactive logins.
An admin-level account admin_temp shows no logons, yet evidence of file creation exists in system logs.
An accounting supervisor creates jsmith_test to export sensitive data through a hidden account.
An HR system created mthompson for a new hire who never started work.
System account used by scheduled jobs
Intruder has hidden their tracks by altering system logs
Personal account created to hide fraudulent activities
Personal account created for an employee who never showed up