User Removed From Group With CA Policy Modification Access (665e2d43-70dc-4ccc-9d27-026c9dd7ed9c)

Monitor and alert on group membership removal of groups that have CA policy modification access

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84)	Attack Pattern	User Removed From Group With CA Policy Modification Access (665e2d43-70dc-4ccc-9d27-026c9dd7ed9c)	Sigma-Rules	1
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	User Removed From Group With CA Policy Modification Access (665e2d43-70dc-4ccc-9d27-026c9dd7ed9c)	Sigma-Rules	1