Detectionmediumtest

Group Has Been Deleted Via Groupdel

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Tuan Le (NCSGroup)Created Mon Dec 268a46f16c-8c4c-82d1-b121-0fdd3ba70a84linux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/groupdel'
    condition: selection

False Positives

Legitimate administrator activities

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

8a46f16c-8c4c-82d1-b121-0fdd3ba70a84

Status

test

Level

medium

Type

Detection

Created

Mon Dec 26

Author

Path

rules/linux/process_creation/proc_creation_lnx_groupdel.yml

Raw Tags

attack.impactattack.t1531