Identifies when an ElastiCache security group has been modified or deleted.

Read More

Identifies when a service account is modified or deleted.

Read More

Identifies when a service account is disabled or deleted in Google Cloud.

Read More

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Read More

Detects when an user account is locked out.

Read More

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Read More

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

Read More

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

Read More