detections
- ID: DT056
- Created: 09th June 2024
- Updated: 23rd October 2025
- Platform: Windows
- MITRE ATT&CK®: DS0002
- Contributor: The ITM Team
User Account Deleted, Windows Event Log
Additional configuration may be required for these Event logs to be generated.
Within the Security log, Event ID 4726 (A user account was deleted) and Event ID 4743 (Computer account was successfully deleted) can be used to identify account deletion.
These two Event logs contain the account domain, name, and SID of both the account requesting the deletion, and the target account to be deleted.
Sections
| ID | Name | Description |
|---|---|---|
| AF013 | Delete User Account | A subject may delete user accounts to obscure their activities and delete all files associated with that user. |
| AF013.001 | Delete Local Windows User | A subject deletes a local Windows user account through administrative tools or commands to obscure activity associated with that identity. Deletion removes the account from the local Security Account Manager (SAM) database and may be accompanied by removal of the associated user profile and files, hindering subsequent attribution and forensic examination. |
| AF013.002 | Delete Windows Active Directory User | A subject deletes a user account from Windows Active Directory to obscure activity associated with the domain identity or interfere with an investigation. Deletion removes the account from the Active Directory namespace, potentially complicating the reconstruction of authentication activity, group memberships, and historical access permissions. |
MITRE ATT&CK® Mapping (1)
ATT&CK Enterprise Matrix Version 20.1