Skip to content
Threat Feed
Subscribe

Tag

Deletion

3 briefs RSS
medium advisory

AWS SAML Provider Deletion Activity

An adversary may delete an AWS SAML provider to disrupt administrative access, hindering incident response and potentially escalating privileges within the AWS environment.

aws cloudtrail saml iam deletion impact
2r 2t
medium advisory

Detection of Azure Application Deletion

This alert identifies when an application is deleted within an Azure environment, which could indicate malicious activity or unintended misconfiguration leading to service disruption.

Azure application deletion impact t1489
2r 1t
medium advisory

Active Directory Group Policy Deletion Detected

Detection of Active Directory Group Policy deletion using event ID 5136, indicating potential malicious activity or misconfiguration.

Splunk Enterprise +2 active-directory group-policy gpo deletion t1484.001
2r 2t