Deleted Local User Accounts
Table of all deleted local user accounts including UserName, ComputerName, aid, aip, and LocalIP.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=UserAccountDeleted
| groupBy([UserName, aid, aip, ComputerName, event_platform, LocalIP, name], function=selectLast([@timestamp]))
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, name])
| sort(@timestamp)deleted_local_user_accounts.yml
T1098
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2025-10-30
