A Security-Enabled Global Group Was Deleted

 1title: A Security-Enabled Global Group Was Deleted
 2id: b237c54b-0f15-4612-a819-44b735e0de27
 3related:
 4    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
 5      type: obsolete
 6status: stable
 7description: Detects activity when a security-enabled global group is deleted
 8references:
 9    - https://www.cisecurity.org/controls/cis-controls-list/
10    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
11    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
12    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
13    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
14author: Alexandr Yampolskyi, SOC Prime
15date: 2023-04-26
16tags:
17    - attack.persistence
18    - attack.t1098
19logsource:
20    product: windows
21    service: security
22detection:
23    selection:
24        EventID:
25            - 4730 # A security-enabled global group was deleted
26            - 634 # Security Enabled Global Group Deleted
27    condition: selection
28falsepositives:
29    - Unknown
30level: low

References

• The 18 CIS Controls

  

  The 18 CIS Controls version 8 combines and consolidates the CIS Controls by activities, rather than by who manages the devices.

  
  Read More

• Document Library

  

  A global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments.

  
  Read More

• %PDF-1.6 %âãÏÓ 3102 0 obj endobj 3108 0 obj /Filter/FlateDecode/ID[ ]/Index[3102 17]/Info 3101 0 R/Length 51/Prev 1061976/Root 3103 0 R/Size 3119/Type/XRef/W[1 2 1]>>stream hÞbbd``b`~$÷‚;÷9ˆ(...

  
  Read More

• Windows Security Log Event ID 4730 - A security-enabled global group was deleted

  

  Windows Security Log Event ID 4730 Operating Systems Windows 2008 R2 and 7 Windows 2012 R2 and 8.1 Windows 2016 and 10 Windows Server 2019 and 2022 Category  • SubcategoryAccount Management  • Secu...

  
  Read More

• Windows Security Log Event ID 634 - Security Enabled Global Group Deleted

  

  Windows Security Log Event ID 634 Operating Systems Windows Server 2000 Windows 2003 and XP CategoryAccount Management Type Success Corresponding events in Windows 2008 and Vista 4730   634: Securi...

  
  Read More

Related rules

• A Member Was Added to a Security-Enabled Global Group
• A Member Was Removed From a Security-Enabled Global Group
• A New Trust Was Created To A Domain
• AWS IAM Backdoor Users Keys
• AWS Route 53 Domain Transfer Lock Disabled