← Back to Explore
kqlHunting
User Account Deletion
Lists the deleted users based on EventId 4726.
Detection Query
SecurityEvent
| where EventID == 4726
| project TimeGenerated, DeletedUser = TargetAccount, Domain = TargetDomainName, Initiator = SubjectAccount, ActivityData Sources
SecurityEvent
Platforms
azure-sentinel
Tags
securityevents
Raw Content
# User Account Deletion
## Query Information
#### Description
Lists the deleted users based on EventId 4726.
## Sentinel
```KQL
SecurityEvent
| where EventID == 4726
| project TimeGenerated, DeletedUser = TargetAccount, Domain = TargetDomainName, Initiator = SubjectAccount, Activity
```