Data Source: Windows Event Log Security 4726

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 0b56dcd7-0f72-4a05-9226-d6059781737b

Author: Patrick Bareiss, Splunk

Description

Logs an event when a user account is deleted from Active Directory.

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Multiple Accounts Deleted	Valid Accounts, Account Manipulation	TTP

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">Caller_Domain</span>
  
  <span class="pill kill-chain">Caller_User_Name</span>
  
  <span class="pill kill-chain">CategoryString</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_nt_domain</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">Error_Code</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">event_time</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Logon_ID</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">object</span>
  
  <span class="pill kill-chain">object_attrs</span>
  
  <span class="pill kill-chain">object_category</span>
  
  <span class="pill kill-chain">object_id</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">PrivilegeList</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">session_id</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_nt_domain</span>
  
  <span class="pill kill-chain">src_subject_user_id</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">src_user_name</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">SubjectDomainName</span>
  
  <span class="pill kill-chain">SubjectLogonId</span>
  
  <span class="pill kill-chain">SubjectUserName</span>
  
  <span class="pill kill-chain">SubjectUserSid</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">ta_windows_security_CategoryString</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Target_Domain</span>
  
  <span class="pill kill-chain">Target_User_Name</span>
  
  <span class="pill kill-chain">TargetDomainName</span>
  
  <span class="pill kill-chain">TargetSid</span>
  
  <span class="pill kill-chain">TargetUserName</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_group</span>
  
  <span class="pill kill-chain">user_name</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

  1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4726</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-02-21T19:38:39.062986300Z'/><EventRecordID>279240</EventRecordID><Correlation/><Execution ProcessID='612' ThreadID='3036'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='TargetUserName'>BRIDGETTE_GARRETT</Data><Data Name='TargetDomainName'>ATTACKRANGE</Data><Data Name='TargetSid'>S-1-5-21-2851375338-1978525053-2422663219-3265</Data><Data Name='SubjectUserSid'>ATTACKRANGE\Administrator</Data><Data Name='SubjectUserName'>Administrator</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x592d1</Data><Data Name='PrivilegeList'>-</Data></EventData></Event>
  202/21/2024 19:38:39.499
  3dcName=ar-win-dc.attackrange.local
  4admonEventType=Deleted
  5Names:
  6    name=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e
  7    distinguishedName=CN=NATALIE_SLATER\0ADEL:d4ffca90-bc57-4143-91a9-5718e10bad0e,CN=Deleted Objects,DC=attackrange,DC=local
  8    cn=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e
  9Object Details:
 10    sAMAccountName=NATALIE_SLATER
 11    objectSid=S-1-5-21-2851375338-1978525053-2422663219-1181
 12    userAccountControl=512
 13    objectGUID=d4ffca90-bc57-4143-91a9-5718e10bad0e
 14    whenChanged=07:38.39 PM, Wed 02/21/2024
 15    whenCreated=09:49.26 PM, Tue 02/20/2024
 16    objectClass=top|person|organizationalPerson|user
 17Event Details:
 18    uSNChanged=82133
 19    uSNCreated=17423
 20    instanceType=4
 21Additional Details:
 22    isRecycled=TRUE
 23    lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local
 24    isDeleted=TRUE
 2502/21/2024 19:38:39.437
 26dcName=ar-win-dc.attackrange.local
 27admonEventType=Deleted
 28Names:
 29    name=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba
 30    distinguishedName=CN=LEILA_SWANSON\0ADEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba,CN=Deleted Objects,DC=attackrange,DC=local
 31    cn=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba
 32Object Details:
 33    sAMAccountName=LEILA_SWANSON
 34    objectSid=S-1-5-21-2851375338-1978525053-2422663219-2953
 35    userAccountControl=512
 36    objectGUID=df268d41-1319-40f9-8c89-2b0c4d64c2ba
 37    whenChanged=07:38.39 PM, Wed 02/21/2024
 38    whenCreated=09:56.04 PM, Tue 02/20/2024
 39    objectClass=top|person|organizationalPerson|user
 40Event Details:
 41    uSNChanged=82132
 42    uSNCreated=29876
 43    instanceType=4
 44Additional Details:
 45    isRecycled=TRUE
 46    lastKnownParent=OU=Devices,OU=ESM,OU=Tier 2,DC=attackrange,DC=local
 47    isDeleted=TRUE
 4802/21/2024 19:38:39.421
 49dcName=ar-win-dc.attackrange.local
 50admonEventType=Deleted
 51Names:
 52    name=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38
 53    distinguishedName=CN=TOM_MCKENZIE\0ADEL:07e62916-f5f2-4a7a-bf85-cade41526b38,CN=Deleted Objects,DC=attackrange,DC=local
 54    cn=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38
 55Object Details:
 56    sAMAccountName=TOM_MCKENZIE
 57    objectSid=S-1-5-21-2851375338-1978525053-2422663219-1792
 58    userAccountControl=512
 59    objectGUID=07e62916-f5f2-4a7a-bf85-cade41526b38
 60    whenChanged=07:38.39 PM, Wed 02/21/2024
 61    whenCreated=09:51.49 PM, Tue 02/20/2024
 62    objectClass=top|person|organizationalPerson|user
 63Event Details:
 64    uSNChanged=82131
 65    uSNCreated=21720
 66    instanceType=4
 67Additional Details:
 68    isRecycled=TRUE
 69    lastKnownParent=OU=ServiceAccounts,OU=AWS,OU=Tier 1,DC=attackrange,DC=local
 70    isDeleted=TRUE
 7102/21/2024 19:38:39.359
 72dcName=ar-win-dc.attackrange.local
 73admonEventType=Deleted
 74Names:
 75    name=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf
 76    distinguishedName=CN=OLIVIA_ANDREWS\0ADEL:f465e25d-fd29-43be-a0f7-4743951d21bf,CN=Deleted Objects,DC=attackrange,DC=local
 77    cn=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf
 78Object Details:
 79    sAMAccountName=OLIVIA_ANDREWS
 80    objectSid=S-1-5-21-2851375338-1978525053-2422663219-2218
 81    userAccountControl=512
 82    objectGUID=f465e25d-fd29-43be-a0f7-4743951d21bf
 83    whenChanged=07:38.39 PM, Wed 02/21/2024
 84    whenCreated=09:53.28 PM, Tue 02/20/2024
 85    objectClass=top|person|organizationalPerson|user
 86Event Details:
 87    uSNChanged=82130
 88    uSNCreated=24713
 89    instanceType=4
 90Additional Details:
 91    isRecycled=TRUE
 92    lastKnownParent=OU=Devices,OU=AWS,OU=Tier 1,DC=attackrange,DC=local
 93    isDeleted=TRUE
 9402/21/2024 19:38:39.327
 95dcName=ar-win-dc.attackrange.local
 96admonEventType=Deleted
 97Names:
 98    name=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e
 99    distinguishedName=CN=LYDIA_RUSSO\0ADEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e,CN=Deleted Objects,DC=attackrange,DC=local
100    cn=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e
101Object Details:
102    sAMAccountName=LYDIA_RUSSO
103    objectSid=S-1-5-21-2851375338-1978525053-2422663219-2336
104    userAccountControl=512
105    objectGUID=9396c805-1c01-4b6f-9ea5-5f8a2d78587e
106    whenChanged=07:38.39 PM, Wed 02/21/2024
107    whenCreated=09:53.53 PM, Tue 02/20/2024
108    objectClass=top|person|organizationalPerson|user
109Event Details:
110    uSNChanged=82129
111    uSNCreated=25541
112    instanceType=4
113Additional Details:
114    isRecycled=TRUE
115    lastKnownParent=OU=Tier 2,OU=Admin,DC=attackrange,DC=local
116    isDeleted=TRUE
11702/21/2024 19:38:39.249
118dcName=ar-win-dc.attackrange.local
119admonEventType=Deleted
120Names:
121    name=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3
122    distinguishedName=CN=ESSIE_SALINAS\0ADEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3,CN=Deleted Objects,DC=attackrange,DC=local
123    cn=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3
124Object Details:
125    sAMAccountName=ESSIE_SALINAS
126    objectSid=S-1-5-21-2851375338-1978525053-2422663219-2134
127    userAccountControl=512
128    objectGUID=1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3
129    whenChanged=07:38.39 PM, Wed 02/21/2024
130    whenCreated=09:53.09 PM, Tue 02/20/2024
131    objectClass=top|person|organizationalPerson|user
132Event Details:
133    uSNChanged=82128
134    uSNCreated=24123
135    instanceType=4
136Additional Details:
137    isRecycled=TRUE
138    lastKnownParent=OU=ServiceAccounts,OU=GOO,OU=Tier 1,DC=attackrange,DC=local
139    isDeleted=TRUE
14002/21/2024 19:38:39.187
141dcName=ar-win-dc.attackrange.local
142admonEventType=Deleted
143Names:
144    name=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5
145    distinguishedName=CN=RILEY_OWEN\0ADEL:8658c536-e6a2-4a87-a42a-766affc4d1f5,CN=Deleted Objects,DC=attackrange,DC=local
146    cn=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5
147Object Details:
148    sAMAccountName=RILEY_OWEN
149    objectSid=S-1-5-21-2851375338-1978525053-2422663219-3098
150    userAccountControl=4194816
151    objectGUID=8658c536-e6a2-4a87-a42a-766affc4d1f5
152    whenChanged=07:38.39 PM, Wed 02/21/2024
153    whenCreated=09:56.32 PM, Tue 02/20/2024
154    objectClass=top|person|organizationalPerson|user
155Event Details:
156    uSNChanged=82127
157    uSNCreated=30896
158    instanceType=4
159Additional Details:
160    isRecycled=TRUE
161    lastKnownParent=OU=Devices,OU=FIN,OU=Stage,DC=attackrange,DC=local
162    isDeleted=TRUE
16302/21/2024 19:38:39.155
164dcName=ar-win-dc.attackrange.local
165admonEventType=Deleted
166Names:
167    name=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6
168    distinguishedName=CN=LEE_OWEN\0ADEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6,CN=Deleted Objects,DC=attackrange,DC=local
169    cn=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6
170Object Details:
171    sAMAccountName=LEE_OWEN
172    objectSid=S-1-5-21-2851375338-1978525053-2422663219-2955
173    userAccountControl=512
174    objectGUID=cefa4d75-89e2-4470-b8a0-fa345385f9d6
175    whenChanged=07:38.39 PM, Wed 02/21/2024
176    whenCreated=09:56.04 PM, Tue 02/20/2024
177    objectClass=top|person|organizationalPerson|user
178Event Details:
179    uSNChanged=82126
180    uSNCreated=29890
181    instanceType=4
182Additional Details:
183    isRecycled=TRUE
184    lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 1,DC=attackrange,DC=local
185    isDeleted=TRUE
18602/21/2024 19:38:39.124
187dcName=ar-win-dc.attackrange.local
188admonEventType=Deleted
189Names:
190    name=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4
191    distinguishedName=CN=KRISTEN_MCGEE\0ADEL:f952e959-30fc-4bb5-bdbb-27b96da724c4,CN=Deleted Objects,DC=attackrange,DC=local
192    cn=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4
193Object Details:
194    sAMAccountName=KRISTEN_MCGEE
195    objectSid=S-1-5-21-2851375338-1978525053-2422663219-3286
196    userAccountControl=512
197    objectGUID=f952e959-30fc-4bb5-bdbb-27b96da724c4
198    whenChanged=07:38.39 PM, Wed 02/21/2024
199    whenCreated=09:57.08 PM, Tue 02/20/2024
200    objectClass=top|person|organizationalPerson|user
201Event Details:
202    uSNChanged=82125
203    uSNCreated=32216
204    instanceType=4
205Additional Details:
206    isRecycled=TRUE
207    lastKnownParent=OU=Groups,OU=FIN,OU=Stage,DC=attackrange,DC=local
208    isDeleted=TRUE
20902/21/2024 19:38:39.062
210dcName=ar-win-dc.attackrange.local
211admonEventType=Deleted
212Names:
213    name=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a
214    distinguishedName=CN=BRIDGETTE_GARRETT\0ADEL:917a7609-22e2-437e-aa50-e97aab73384a,CN=Deleted Objects,DC=attackrange,DC=local
215    cn=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a
216Object Details:
217    sAMAccountName=BRIDGETTE_GARRETT
218    objectSid=S-1-5-21-2851375338-1978525053-2422663219-3265
219    userAccountControl=512
220    objectGUID=917a7609-22e2-437e-aa50-e97aab73384a
221    whenChanged=07:38.39 PM, Wed 02/21/2024
222    whenCreated=09:57.04 PM, Tue 02/20/2024
223    objectClass=top|person|organizationalPerson|user
224Event Details:
225    uSNChanged=82124
226    uSNCreated=32069
227    instanceType=4
228Additional Details:
229    isRecycled=TRUE
230    lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local
231    isDeleted=TRUE

Required Output Fields

dest

Source: GitHub | Version: 5