Who Deleted An AD User

Who deleted an AD user (`SecurityEvent` EventID `4726`) over the last 90 days.

KQL Library  /  Identity

 Identity who-deleted-an-ad-user.kql

Who deleted an AD user (`SecurityEvent` EventID `4726`) over the last 90 days.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
SecurityEvent
| where TimeGenerated > ago (90d)
| where EventID == "4726"
| extend Actor_ = Account
| project-reorder TimeGenerated, Activity, Actor_, TargetUserName, Computer