Elastic low stable eql

Linux User or Group Deletion

This rule detects the deletion of user or group accounts on Linux systems. Adversaries may use these commands to remove accounts to cover their tracks or disrupt operations.

View Source

Detection Logic

iam where host.os.type == "linux" and event.type in ("group", "user") and event.type == "deletion" and event.outcome == "success"

Field Validations

Loading…

Comments (0)

Loading comments...