detection.wiki

Microsoft-Windows-Security-Auditing › Event 4726

Event ID 4726 — A user account was deleted.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Account Management → User Account Management
Collection Priority
Recommended (Palantir, others)
Opcode
Info

Description

A user account was deleted.

Message #

A user account was deleted.

Subject:
	Security ID: %4
	Account Name: %5
	Account Domain: %6
	Logon ID: %7

Target Account:
	Security ID: %3
	Account Name: %1
	Account Domain: %2

Additional Information:
	Privileges	%8

Fields #

NameDescription
Account_Name[Target Account] Account Name.
Account_Domain[Target Account] Account Domain.
Security_ID[Target Account] Security ID.
Security_ID[Subject] Security ID.
Account_Name[Subject] Account Name.
Account_Domain[Subject] Account Domain.
Logon_ID[Subject] Logon ID.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4726,
    "version": 0,
    "level": 0,
    "task": 13824,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2022-01-24T17:03:25.009874Z",
    "event_record_id": 1934526,
    "correlation": {},
    "execution": {
      "process_id": 480,
      "thread_id": 1496
    },
    "channel": "Security",
    "computer": "fs03vuln.offsec.lan",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TargetUserName": "3teamssixf$",
    "TargetDomainName": "FS03VULN",
    "TargetSid": "S-1-5-21-2721507831-1374043488-2540227515-1008",
    "SubjectUserSid": "S-1-5-21-4230534742-2542757381-3142984815-1111",
    "SubjectUserName": "admmig",
    "SubjectDomainName": "OFFSEC",
    "SubjectLogonId": "0x14f509e2",
    "PrivilegeList": "-"
  }
}

Detection Patterns #

Detection Rules #

View all rules referencing this event →

Splunk # view in reference

  • Windows Multiple Accounts Deleted source: The following analytic detects the deletion of more than five unique Windows accounts within a 10-minute period, using Event Code 4726 from the Windows Security Event Log. It leverages the `wineventlog_security` dataset, segmenting data into 10-minute intervals to identify suspicious account deletions. This activity is significant as it may indicate an attacker attempting to erase traces of their actions. If confirmed malicious, this could lead to unauthorized access removal, hindering incident response and forensic investigations.

References #