Account Access Removal detection rulesT1531

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

aws

Identifies when a service account is modified or deleted.

azure

Identifies when a service account is disabled or deleted in Google Cloud.

gcp

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

linux · process_creation

Detects when an user account is locked out.

okta

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

windows · ps_script

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

linux · process_creation

Identifies when an ElastiCache security group has been modified or deleted.

aws

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

windows