Bulk Deletion Changes To Privileged Account Permissions (102e11e3-2db5-4c9e-bc26-357d42585d21)
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Account Manipulation - T1098 (a10641f4-87b4-45a3-a906-92a149cb2c27) | Attack Pattern | Bulk Deletion Changes To Privileged Account Permissions (102e11e3-2db5-4c9e-bc26-357d42585d21) | Sigma-Rules | 1 |