Analytics Informational
✕

Multiple user accounts were deleted

A user deleted multiple user accounts.

Module:
Identity Analytics
Data source:
Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003) Impact (TA0040)
ATT&CK techniques: Valid Accounts (T1078) Account Access Removal (T1531)
Attacker's goals:

Persistence using a valid account.

Investigative actions:

Check the user who deleted the accounts and verify the activity.* Look into the recent activity of the deleted accounts and whether they were temporary or dormant.

Test period:
1 Hour
Deduplication:
1 Day
1 variation:
  • A user deleted multiple users for the first time Low (parent: Informational)