Account Creation And Deletion within a given time

[hagjos43]

Hello, I'm trying to create a query to monitor when users create accounts and then within a given time window delete the account.

I've got this so far:

sourcetype=WinEventLog:Security (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) | eval status=case(EventCode=630, "Account Creation", EventCode=4726, "Account Creation", EventCode=624, "Account Deletion", EventCode=4720, "Account Deletion") |

The Pseudo code for what I'm looking for would be:

. . . | where Account Creation AND Account Deletion occur within x hours

Thanks!

[renjujacob88]

Here with the modified one

index=wineventlog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) |rex field=_raw "(?ms)^(?P\d+\S+\s\S*\s\w+)" | eval status=case(EventCode=630, "Account Deletion", EventCode=4726, "Account Deletion", EventCode=624, "Account Creation", EventCode=4720, "Account Creation") |transaction user startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2 | where duration < 86400 | eval Account_Created_Time=mvindex(time,0)|eval
Account_Deleted_Time=mvindex(time,1) |eval Created_Account_EventCode =mvindex(EventCode,0)|eval Deleted_Account_EventCode =mvindex(EventCode,1)|eval Account_Created_By =mvindex(src_user,0)|eval Account_Deleted_By=mvindex(src_user,1) | table Account_Created_Time Account_Created_By Created_Account_EventCode user
Account_Deleted_Time Deleted_Account_EventCode Account_Deleted_By | eval Account_Deleted_By=if(isnull(Account_Deleted_By),Account_Created_By,Account_Deleted_By) | Rename user as Account_Created_And_Deleted |

[renjujacob88]

Modified query

index=wineventlog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) |rex field=_raw "(?ms)^(?P\d+\S+\s\S*\s\w+)" | eval status=case(EventCode=630, "Account Deletion", EventCode=4726, "Account Deletion", EventCode=624, "Account Creation", EventCode=4720, "Account Creation") |transaction user startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2 | where duration < 86400 | eval Account_Created_Time=mvindex(time,0)|eval Account_Deleted_Time=mvindex(time,1) |eval Created_Account_EventCode =mvindex(EventCode,0)|eval Deleted_Account_EventCode =mvindex(EventCode,1)|eval Account_Created_By =mvindex(src_user,0)|eval Account_Deleted_By=mvindex(src_user,1) | table Account_Created_Time Account_Created_By Created_Account_EventCode user Account_Deleted_Time Deleted_Account_EventCode Account_Deleted_By | eval Account_Deleted_By=if(isnull(Account_Deleted_By),Account_Created_By,Account_Deleted_By) | Rename user as Account_Created_And_Deleted |

[aaronandshag]

Hello, I've got one right here for ya!

sourcetype=WinEventLog:Security (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) | eval status=case(EventCode=630, "Account Deletion", EventCode=4726, "Account Deletion", EventCode=624, "Account Creation", EventCode=4720, "Account Creation") |transaction user startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2  | where duration < 3600

I've tested it and get correct results.

[aaronandshag]

Hello,

So the event codes were improperly associated with the event descriptions, fixed that.

sourcetype=WinEventLog:Security (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) | eval status=case(EventCode=630, "Account Deletion", EventCode=4726, "Account Deletion", EventCode=624, "Account Creation", EventCode=4720, "Account Creation") |transaction user startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2  | where duration < 3600

This works in my environment.

[somesoni2]

Try this

sourcetype=WinEventLog:Security (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) | eval status=case(EventCode=630, "Account Creation", EventCode=4726, "Account Creation", EventCode=624, "Account Deletion", EventCode=4720, "Account Deletion") 
|transaction startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2 | where duration < X*3600

where X is your hours.

[cdev24]

But this will not valid for same user who is created and deleted.

Above query is valid for X user account created and Y user account got deleted.