Find_deleted_accounts_and_by_whom

id: e5b0ee9b-7fa4-4641-8363-bd2d72f1bf5b
name: Find_deleted_accounts_and_by_whom
description: |
  Find accounts that have been deleted and by whom
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
- IdentityDirectoryEvents
tactics:
- Credential Access
query: |
 IdentityDirectoryEvents
 | where ActionType == "Account deleted"
 | extend parsed=parse_json(AdditionalFields)
 | extend ACTOR_ENTITY_USER = iff( isnull(AdditionalFields.["ACTOR.ENTITY_USER"]), AdditionalFields.["ACTOR.ENTITY_USER"], AdditionalFields.["ACTOR.ENTITY_USER"])
 | extend ACTOR_ENTITY_USER = iff( isnull(ACTOR_ENTITY_USER), AdditionalFields.["ACTOR.ENTITY_USER"], ACTOR_ENTITY_USER)
 | project Timestamp, ActionType, TargetAccountUpn, AccountName, ACTOR_ENTITY_USER, AdditionalFields
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Matt Novitsch
    support:
        tier: Community
    categories:
        domains: [ "Security - Identity" ]