A global security group was deleted.
Deletion of security groups disrupts access controls and can blind monitoring (deleting groups used in SACL). Sabotage of AD structure.
Alert: deletion of groups used for security, admin, or IT functions. Alert: outside business hours.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Impact | Account Access Removal (T1531) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4730 // A security-enabled global group was deleted
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4730
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A security-enabled global group was deleted — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A security-enabled global group was deleted. A global security group was deleted.
Event 4730 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4730 is associated with: Account Access Removal (T1531).
Alert: deletion of groups used for security, admin, or IT functions. Alert: outside business hours.