A Security-Enabled Global Group Was Deleted
Detects activity when a security-enabled global group is deleted
Sigma rule (View on GitHub)
1title: A Security-Enabled Global Group Was Deleted
2id: b237c54b-0f15-4612-a819-44b735e0de27
3related:
4 - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
5 type: obsoletes
6status: stable
7description: Detects activity when a security-enabled global group is deleted
8references:
9 - https://www.cisecurity.org/controls/cis-controls-list/
10 - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
11 - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
12 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
13 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
14author: Alexandr Yampolskyi, SOC Prime
15date: 2023/04/26
16logsource:
17 product: windows
18 service: security
19detection:
20 selection:
21 EventID:
22 - 4730 # A security-enabled global group was deleted
23 - 634 # Security Enabled Global Group Deleted
24 condition: selection
25falsepositives:
26 - Unknown
27level: low