A Security-Enabled Global Group Was Deleted

Title: A Security-Enabled Global Group Was Deleted
Status: stable
Description:Detects activity when a security-enabled global group is deleted
References:
  -https://www.cisecurity.org/controls/cis-controls-list/
  -https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  -https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
  -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
Author: Alexandr Yampolskyi, SOC Prime
Date: 2023-04-26
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'4730'
      -'634'

  condition:selection
Falsepositives:
  -Unknown
Level: low