Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More

Identifies when an ElastiCache security group has been modified or deleted.

Read More

Identifies when a service account is modified or deleted.

Read More

Identifies when a service account is disabled or deleted in Google Cloud.

Read More

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Read More

Detects when an user account is locked out.

Read More

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Read More

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

Read More

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

Read More