A Security-Enabled Global Group Was Deleted

calendar Aug 28, 2023 · attack.persistence attack.t1098  ·
Share on: linkedin copy

Detects activity when a security-enabled global group is deleted

Sigma rule (View on GitHub)

 1title: A Security-Enabled Global Group Was Deleted
 2id: b237c54b-0f15-4612-a819-44b735e0de27
 3related:
 4    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
 5      type: obsoletes
 6status: stable
 7description: Detects activity when a security-enabled global group is deleted
 8references:
 9    - https://www.cisecurity.org/controls/cis-controls-list/
10    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
11    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
12    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
13    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
14author: Alexandr Yampolskyi, SOC Prime
15date: 2023/04/26
16tags:
17    - attack.persistence
18    - attack.t1098
19logsource:
20    product: windows
21    service: security
22detection:
23    selection:
24        EventID:
25            - 4730 # A security-enabled global group was deleted
26            - 634 # Security Enabled Global Group Deleted
27    condition: selection
28falsepositives:
29    - Unknown
30level: low

References

Related rules

to-top