Detections
- Home
- - Detections
- -DT015
- ID: DT015
- Created: 30th May 2024
- Updated: 23rd October 2025
- Platform: Windows
- MITRE ATT&CK®: DS0002
- Contributor: The ITM Team
Windows Local Account Deleted
A subject may delete a local Windows user account to delete files associated with this user.
Event ID 4726 in Windows Security logs is called "User Account Deleted." This event is logged when a user account is deleted from the local system.
This may represent an anti-forensics technique if there is no reasonable explanation for why the user was deleted from the system.
MITRE ATT&CK® Mapping (1)
ATT&CK Enterprise Matrix Version 17.1