A user account was deleted. TargetUserName=deleted account.
Backdoor account cleanup after use (T1070). Created-used-deleted in <24 h is a classic backdoor lifecycle. Also destructive sabotage.
Alert: deletion of accounts with recent 4624 logons. Alert: deletion of admin/service accounts. Correlate with 4720 — created then deleted <24 h is suspicious.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Indicator Removal (T1070) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: User Account Deleted
status: stable
description: Detects deletion of user accounts
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4726
condition: selection
falsepositives:
- Legitimate user off-boarding
level: medium
tags:
- attack.defense_evasion
- attack.t1070SecurityEvent
| where EventID == 4726 // A user account was deleted
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4726
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A user account was deleted — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A user account was deleted. A user account was deleted. TargetUserName=deleted account.
Event 4726 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4726 is associated with: Indicator Removal (T1070).
Alert: deletion of accounts with recent 4624 logons. Alert: deletion of admin/service accounts. Correlate with 4720 — created then deleted <24 h is suspicious.