An AD object was deleted.
Deletion of OUs, GPOs, or privileged objects to cover tracks or cause damage.
Alert: deletion of OUs, GPOs, or privileged group objects. Alert: outside business hours.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Indicator Removal (T1070) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5141 // A directory service object was deleted
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5141
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A directory service object was deleted — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A directory service object was deleted. An AD object was deleted.
Event 5141 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Event 5141 is associated with: Indicator Removal (T1070).
Alert: deletion of OUs, GPOs, or privileged group objects. Alert: outside business hours.