Volver al hub

Deleted Local User Accounts

Table of all deleted local user accounts including UserName, ComputerName, aid, aip, and LocalIP.

EDRmonitoringT1098
FDR intermediatepor ByteRay GmbH (cql-hub.com) 1 min read

Query

#event_simpleName=UserAccountDeleted
| groupBy([UserName, aid, aip, ComputerName, event_platform, LocalIP, name], function=selectLast([@timestamp]))
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, name])
| sort(@timestamp)

Explicación

Importado desde cql-hub.com. Agrega explicación de pipes aquí.

Variables a ajustar

Revisa y ajusta los valores según tu entorno.