UBA : DoS Attack by Account Deletion

Standardmäßig aktiviert

Falsch

senseValue-Standardwert

10

Beschreibung

Erkennt DoS-Attacken, indem die Anzahl der Kontolöschereignisse auf Basis eines festen Schwellenwerts innerhalb eines festgelegten Zeitraums überprüft wird.

Regeln für die Unterstützung

Protokollquellentypen

Amazon AWS CloudTrail (Ereignis-ID: DeleteUser)

Application Security DbProtect (Ereignis-ID: Login revoked - Windows, Login dropped - standard, Database role - dropped, Database user revoked)

Aruba Mobility Controller (Ereignis-ID: authmgr_user_del)

Box (Ereignis-ID: DELETE_USER)

Brocade FabricOS (Ereignis-ID: SEC-1181, SEC-3028)

CA ACF2 (EventID: ACF2-L)

Check Point (Ereignis-ID: user_deleted, device_deleted, User Deleted)

Cilasoft QJRN/400 (Ereignis-ID: C20020)

Cisco Adaptive Security Appliance (ASA) (Ereignis-ID: %PIX|ASA-5-502102, %ASA-5-502102)

Cisco FireSIGHT Management Center (Ereignis-ID: USER_REMOVED_CHANGE_EVENT)

Cisco Firewall Services Module (FWSM) (Ereignis-ID: 502102)

Cisco Identity Services Engine (Ereignis-ID: 86008, 86028)

Cisco NAC Appliance (Ereignis-ID: CCA-1453, CCA-1502)

Cisco Nexus (Ereignis-ID: SECURITYD-6-DELETE_STALE_USER_ACCOUNT)

Cisco Wireless LAN Controllers (Ereignis-ID: 1.3.6.1.4.1.9.9.515.0.1)

CloudPassage Halo (Ereignis-ID: Halo user deleted, Local account deleted (linux only))

CorreLog Agent for IBM zOS (Ereignis-ID: RACF DELUSER: No Violations)

Custom Rule Engine (Ereignis-ID: 3035, 3043)

Cyber-Ark Vault (Ereignis-ID: 276)

EMC VMWare (Ereignis-ID: AccountRemovedEvent)

Extreme Dragon Network IPS (Ereignis-ID: HOST:LINUX:USER-DELETED, HOST:WIN:ACCOUNT-DELETED)

Extreme Matrix K/N/S Series Switch (Ereignis-ID: User Deleted Event, has been deleted)

Extreme NAC (Ereignis-ID: Deleted registered user)

Extreme NetsightASM (Ereignis-ID: UserRemove)

Flow Classification Engine (Ereignis-ID: 3035, 3043)

Forcepoint Sidewinder (Ereignis-ID: passport deletion, all passports revoked)

HBGary Active Defense (Ereignis-ID: DeleteUser)

HP Network Automation (Ereignis-ID: User Deleted)

Huawei S Series Switch (Ereignis-ID: SSH/6/DELUSER_SUCCESS)

IBM AIX Audit (Ereignis-ID: USER_Remove SUCCEEDED)

IBM AIX Server (Ereignis-ID: USER_Remove)

IBM DB2 (Ereignis-ID: DROP_USER SUCCESS)

IBM DataPower (EventID: 0x81000136)

IBM IMS (Ereignis-ID: USER DELETED)

IBM Proventia Network Intrusion Prevention System (IPS) (Ereignis-ID: Delete User)

IBM Resource Access Control Facility (RACF) (Ereignis-ID: 80 17.2, DELUSER_SUCCESS, 80 17.0)

IBM Security Access Manager for Enterprise Single Sign-On (Ereignis-ID: REVOKE_IMS_ID, DELETE_IMS_ID)

IBM Security Directory Server (Ereignis-ID: SDS Audit)

IBM Security Identity Governance (Ereignis-ID: 50, 43, 70005)

IBM Security Identity Manager (Ereignis-ID: Delete SUCCESS, Delete SUBMITTED, Delete Success)

IBM SmartCloud Orchestrator (Ereignis-ID: user)

IBM Tivoli Access Manager for e-business (Ereignis-ID: 13408 - Succeeded, 13408 Command Succeeded)

IBM i (Ereignis-ID: GSL2502, M250100, DO_USRPRF, GSL2602, GSL2601, M260100, MC@0400, GSL2501)

IBM z/OS (Ereignis-ID: 80 1.35)

Juniper Networks Network and Security Manager (Ereignis-ID: adm24473)

Linux OS (Ereignis-ID: userDel, Account Deleted, DEL_USER)

McAfee Application/Change Control (Ereignis-ID: USER_ACCOUNT_DELETED)

McAfee ePolicy Orchestrator (Ereignis-ID: 20793)

Microsoft ISA (Ereignis-ID: user removed)

Microsoft Office 365 (Ereignis-ID: Delete User-PartiallySucceded, Delete user-success, Delete User-success, Delete user-PartiallySucceded)

Microsoft SQL Server (Ereignis-ID: 24129, DR - US, DR - SL, DR - LX, DR - AR,DR - SU, 24076, 24123, 38)

Microsoft Windows Security Event Log (Ereignis-ID: 4743, 630, 1327, 647, 4726)

Netskope Active (Ereignis-ID: Delete Admin, Deleted admin)

Nortel Application Switch (Ereignis-ID: User Deleted)

Novell eDirectory (Ereignis-ID: DELETE_ACCOUNT)

OS Services Qidmap (Ereignis-ID: Account Deleted, User Deleted)

OSSEC (Ereignis-ID: 18112)

Okta (Ereignis-ID: core.user_group_member.user_remove, app.generic.import.details.delete_user)

Oracle Enterprise Manager (Ereignis-ID: Computer Delete (successful), User Delete (successful))

Oracle RDBMS Audit Record (Ereignis-ID: DROP USER-Standard:1, 53:1, 53:0,DROP USER-Standard:0, 53)

PGP Universal Server (Ereignis-ID: ADMIN_DELETED_USER)

Palo Alto Endpoint Security Manager (Ereignis-ID: User Deleted)

Pulse Secure Pulse Connect Secure (Ereignis-ID: SYN24849, ADM20722, ADM24473, SYN24745, SYN24850)

RSA Authentication Manager (Ereignis-ID: unknown, Deleted user, REMOVE_ORPHANED_PRINCIPALS, REMOTE_PRINCIPAL_DELETE, DELETE_PRINCIPAL)

SIM Audit (Ereignis-ID: Configuration-UserAccount-AccountDeleted)

STEALTHbits StealthINTERCEPT (Ereignis-ID: Active DirectorycomputerObject DeletedTrueFalse, Active DirectoryuserObject DeletedTrueFalse, Console user/group deleted, Console user/group deleted)

SafeNet DataSecure/KeySecure (Ereignis-ID: Removed user)

Skyhigh Networks Cloud Security Platform (Ereignis-ID: 10017)

Solaris BSM (Ereignis-ID: delete user)

SonicWALL SonicOS (Ereignis-ID: 559, 1157, 1158)

Trend Micro Deep Security (Ereignis-ID: 651)

Universal DSM (Ereignis-ID: Computer Account Removed, User Account Removed)

VMware vCloud Director (Ereignis-ID: com/vmware/vcloud/event/user/remove, com/vmware/vcloud/event/user/delete)

Vormetric Data Security (Ereignis-ID: DAO0090I)

iT-CUBE agileSI (EventID: AU8, U0)