Query

CloudAppEvents
| where ActionType == "Hard Delete user."
| extend DeletedUser = parse_json(RawEventData).ObjectId
| project
     Timestamp,
     ActionType,
     Application,
     InitiatingUser = AccountDisplayName,
     DeletedUser

About this query

Hunt for activities where Hard Delete user was performed

Query Information

Description

This query lists activities where a hard user delete has been performed.

Defender XDR

Sentinel

CloudAppEvents
| where ActionType == "Hard Delete user."
| extend DeletedUser = parse_json(RawEventData).ObjectId
| project
     TimeGenerated,
     ActionType,
     Application,
     InitiatingUser = AccountDisplayName,
     DeletedUser

Explanation

This query is designed to identify and list activities where a "hard delete" action was performed on a user account. It searches through cloud application events to find instances of this specific action. Here's a breakdown of what the query does:

Data Source: It looks at the CloudAppEvents table, which contains records of various actions performed in cloud applications.
Filter: The query filters the events to only include those where the ActionType is "Hard Delete user." This means it focuses on actions where a user account was permanently deleted.
Extract Information: It uses the extend function to extract the ObjectId of the deleted user from the RawEventData field and assigns it to a new column called DeletedUser.
Select Columns: The query then selects (or projects) specific columns to display in the results:
- Timestamp (or TimeGenerated in the Sentinel version): The time when the event occurred.
- ActionType: The type of action performed, which in this case is "Hard Delete user."
- Application: The application where the action took place.
- InitiatingUser: The display name of the user who initiated the delete action.
- DeletedUser: The identifier of the user who was deleted.

In summary, this query helps security analysts or administrators track and review instances where user accounts were permanently deleted, providing details about when and where the action occurred, who initiated it, and which user was deleted.

KQL Search