Group Has Been Deleted Via Groupdel

Title: Group Has Been Deleted Via Groupdel
Status: test
Description:Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
References:
  -https://linuxize.com/post/how-to-delete-group-in-linux/
  -https://www.cyberciti.biz/faq/linux-remove-user-command/
  -https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  -https://linux.die.net/man/8/groupdel
Author: Tuan Le (NCSGroup)
Date: 2022-12-26
modified:None
Tags:

• -'attack.impact'
• -'attack.t1531'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith: '/groupdel'
  condition:selection
Falsepositives:
  -Legitimate administrator activities
Level: medium