AN0334
Analytic 0334
Windows
Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.
WinEventLog:Security
EventCode=4723, 4724, 4740
WinEventLog:Sysmon
EventCode=1
[UserContext]
Account performing the operation (e.g., Domain Admins vs. local users)
[TimeWindow]
Alert only on actions outside of maintenance windows
[ParentProcessName]
Detect suspicious process lineage (e.g., powershell.exe launching net.exe)
AN0335
Analytic 0335
Linux
Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.
auditd:SYSCALL
SYSCALL record where exe contains passwd/userdel/chage and auid != root
NSM:Connections
Accepted password or publickey for user from remote IP
[ExecPath]
Binary path for passwd or userdel, which may vary by distro
[NonRootUIDThreshold]
Alert only if auid != root or expected service account
AN0336
Analytic 0336
macOS
Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.
macos:unifiedlog
command includes dscl . delete or sysadminctl --deleteUser
macos:unifiedlog
successful sudo or authentication for account not normally associated with admin actions
[CommandLinePattern]
Allow variation in dscl/sysadminctl command structure
[AnomalousUserFlag]
Detect new or rarely seen users performing user removal
AN0337
Analytic 0337
ESXi
Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.
esxi:hostd
method=RemoveUser or esxcli system account remove invocation
esxi:vpxa
user login from unexpected IP or non-admin user role
[RemoteUserRole]
ESXi role triggering the change (e.g., Administrator vs. Viewer)
[ExpectedIPs]
IP ranges authorized to conduct admin-level actions
AN0338
Analytic 0338
Office Suite
O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.
m365:unified
Remove-Mailbox, Set-Mailbox
m365:signinlogs
Sign-in from anomalous location or impossible travel condition
[RoleAssignment]
Determine if operation was delegated to expected admin group
[GeoThreshold]
Trigger on unusual geographic login sources
AN0339
Analytic 0339
SaaS
Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.
saas:okta
user.lifecycle.delete, user.account.lock
[BulkActionThreshold]
Trigger if multiple deletions occur within a short period
[SessionDeviceType]
Alert on deletions initiated from unfamiliar device contexts