User Account Deletion

Description

Lists the deleted users based on EventId 4726.

Query · kql

SecurityEvent
| where EventID == 4726
| project TimeGenerated, DeletedUser = TargetAccount, Domain = TargetDomainName, Initiator = SubjectAccount, Activity
Raw source User Account Deletion · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# User Account Deletion

## Query Information

#### Description
Lists the deleted users based on EventId 4726.


## Sentinel
```KQL
SecurityEvent
| where EventID == 4726
| project TimeGenerated, DeletedUser = TargetAccount, Domain = TargetDomainName, Initiator = SubjectAccount, Activity 
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.