Why is my Detection alerting on a user called PANTHERACCOUNTADMIN?
This happens programmatically when Panther deploys new code and runs migrations or updates. Panther uses that account when any of the ACCOUNTADMIN, SYSADMIN or SECURITYADMIN roles are needed.