Windows Multiple User Account Deletions

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•4•0•6

Detects five or more distinct Windows user-account deletion events (Event ID 4726) performed by the same actor on the same host within a one-hour time window, which may indicate unauthorized account access removal or malicious impact activity.