mirror of
https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries
synced 2026-06-08 17:17:21 +00:00
@
1.3 KiB
1.3 KiB
Impact
T1531 Account Access Removal
Atomics: T1531
Detects the deletion of a local user account or removal of Active Directory groups through powershell cmdlets. No detection for account password resets for purpose of impact due to false detections.
SrcProcCmdline RegExp "net\s+user(?:(?!\s+/delete)(?:.|\n))*\s+/delete" OR TgtProcCmdLine ContainsCIS "Remove-ADGroupMember" OR SrcProcCmdScript ContainsCIS "Remove-ADGroupMember"
T1485 Data Destruction
Atomics: T1485
Detection of SDelete (by display name) and execution of DD command on *nix operating systems.
(AgentOS In ("linux","osx") AND TgtProcName = "dd" AND TgtProcCmdLine ContainsCIS "of=") OR TgtProcDisplayName = "Secure file delete"
T1490 Inhibit System Recovery
Atomics: T1490
T1489 Service Stop
Atomics: T1489
T1529 System Shutdown/Reboot
Atomics: T1529