Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0003 ✕ technique: T1531 ✕
Show ATT&CK heatmapMultiple user accounts were deleted Informational Identity Analytics 1 variation
A user deleted multiple user accounts.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- 1 Hour
- Deduplication:
- 1 Day
ATT&CK tactics: Persistence (TA0003) Impact (TA0040)ATT&CK techniques: Valid Accounts (T1078) Account Access Removal (T1531)Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)Attacker's goals: Persistence using a valid account.Investigative actions: Check the user who deleted the accounts and verify the activity. Look into the recent activity of the deleted accounts and whether they were temporary or dormant.Variations
A user deleted multiple users for the first time
Low overridden
A user deleted multiple user accounts. overridden