Hayabusa medium test sigma

Remove Account From Domain Admin Group

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

View Source

Detection Logic

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection": {
    "ScriptBlockText
| contains
| all": [
      "Remove-ADGroupMember",
      "-Identity ",
      "-Members "
    ]
  },
  "condition": "ps_script and selection"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...