UBA : DoS Attack by Account Deletion

기본적으로 사용 가능

False

senseVaule 기본값

10

설명

일정한 기간 내의 고정 임계값에 대해 계정 삭제 이벤트 수를 확인하여 DoS 공격을 발견합니다.

지원 룰

로그 소스 유형

Amazon AWS CloudTrail(이벤트 ID: DeleteUser)

Application Security DbProtect(이벤트 ID: Login revoked - Windows, Login dropped - standard, Database role - dropped, Database user revoked)

Aruba Mobility Controller(이벤트 ID: authmgr_user_del)

Box(이벤트 ID: DELETE_USER)

Brocade FabricOS(이벤트 ID: SEC-1181, SEC-3028)

CA ACF2 (EventID: ACF2-L)

Check Point(이벤트 ID: user_deleted, device_deleted, User Deleted)

Cilasoft QJRN/400(이벤트 ID: C20020)

Cisco Adaptive Security Appliance(ASA)(이벤트 ID: %PIX|ASA-5-502102, %ASA-5-502102)

Cisco FireSIGHT Management Center(이벤트 ID: USER_REMOVED_CHANGE_EVENT)

Cisco Firewall Services Module(FWSM)(이벤트 ID: 502102)

Cisco Identity Services Engine(이벤트 ID: 86008, 86028)

Cisco NAC Appliance(이벤트 ID: CCA-1453, CCA-1502)

Cisco Nexus(이벤트 ID: SECURITYD-6-DELETE_STALE_USER_ACCOUNT)

Cisco Wireless LAN Controllers(이벤트 ID: 1.3.6.1.4.1.9.9.515.0.1)

CloudPassage Halo(이벤트 ID: Halo user deleted, Local account deleted(linux에만 해당))

CorreLog Agent for IBM zOS(이벤트 ID: RACF DELUSER: No Violations)

Custom Rule Engine(이벤트 ID: 3035, 3043)

Cyber-Ark Vault(이벤트 ID: 276)

EMC VMWare(이벤트 ID: AccountRemovedEvent)

Extreme Dragon Network IPS(이벤트 ID: HOST:LINUX:USER-DELETED, HOST:WIN:ACCOUNT-DELETED)

Extreme Matrix K/N/S Series Switch(이벤트 ID: User Deleted Event, has been deleted)

Extreme NAC(이벤트 ID: Deleted registered user)

Extreme NetsightASM(이벤트 ID: UserRemove)

Flow Classification Engine(이벤트 ID: 3035, 3043)

Forcepoint Sidewinder(이벤트 ID: passport deletion, all passports revoked)

HBGary Active Defense(이벤트 ID: DeleteUser)

HP Network Automation(이벤트 ID: User Deleted)

Huawei S Series Switch(이벤트 ID: SSH/6/DELUSER_SUCCESS)

IBM AIX Audit(이벤트 ID: USER_Remove SUCCEEDED)

IBM AIX Server(이벤트 ID: USER_Remove)

IBM DB2(이벤트 ID: DROP_USER SUCCESS)

IBM DataPower (EventID: 0x81000136)

IBM IMS(이벤트 ID: USER DELETED)

IBM Proventia Network Intrusion Prevention System(IPS)(이벤트 ID: Delete User)

IBM Resource Access Control Facility(RACF)(이벤트 ID: 80 17.2, DELUSER_SUCCESS, 80 17.0)

IBM Security Access Manager for Enterprise Single Sign-On(이벤트 ID: REVOKE_IMS_ID, DELETE_IMS_ID)

IBM Security Directory Server(이벤트 ID: SDS Audit)

IBM Security Identity Governance(이벤트 ID: 50, 43, 70005)

IBM Security Identity Manager(이벤트 ID: Delete SUCCESS, Delete SUBMITTED, Delete Success)

IBM SmartCloud Orchestrator(이벤트 ID: user)

IBM Tivoli Access Manager for e-business(이벤트 ID: 13408 - Succeeded, 13408 Command Succeeded)

IBM i(이벤트 ID: GSL2502, M250100, DO_USRPRF, GSL2602, GSL2601, M260100, MC@0400, GSL2501)

IBM z/OS(이벤트 ID: 80 1.35)

Juniper Networks Network and Security Manager(이벤트 ID: adm24473)

Linux OS(이벤트 ID: userDel, Account Deleted, DEL_USER)

McAfee Application/Change Control(이벤트 ID: USER_ACCOUNT_DELETED)

McAfee ePolicy Orchestrator(이벤트 ID: 20793)

Microsoft ISA(이벤트 ID: user removed)

Microsoft Office 365(이벤트 ID: Delete User-PartiallySucceded, Delete user-success, Delete User-success, Delete user-PartiallySucceded)

Microsoft SQL Server(이벤트 ID: 24129, DR - US, DR - SL, DR - LX, DR - AR,DR - SU, 24076, 24123, 38)

Microsoft Windows Security Event Log(이벤트 ID: 4743, 630, 1327, 647, 4726)

Netskope Active(이벤트 ID: Delete Admin, Deleted admin)

Nortel Application Switch(이벤트 ID: User Deleted)

Novell eDirectory(이벤트 ID: DELETE_ACCOUNT)

OS Services Qidmap(이벤트 ID: Account Deleted, User Deleted)

OSSEC(이벤트 ID: 18112)

Okta(이벤트 ID: core.user_group_member.user_remove, app.generic.import.details.delete_user)

Oracle Enterprise Manager(이벤트 ID: Computer Delete (successful), User Delete (successful))

Oracle RDBMS Audit Record(이벤트 ID: DROP USER-Standard:1, 53:1, 53:0,DROP USER-Standard:0, 53)

PGP Universal Server(이벤트 ID: ADMIN_DELETED_USER)

Palo Alto Endpoint Security Manager(이벤트 ID: User Deleted)

Pulse Secure Pulse Connect Secure(이벤트 ID: SYN24849, ADM20722, ADM24473, SYN24745, SYN24850)

RSA Authentication Manager(이벤트 ID: unknown, Deleted user, REMOVE_ORPHANED_PRINCIPALS, REMOTE_PRINCIPAL_DELETE, DELETE_PRINCIPAL)

SIM Audit(이벤트 ID: Configuration-UserAccount-AccountDeleted)

STEALTHbits StealthINTERCEPT(이벤트 ID: Active DirectorycomputerObject DeletedTrueFalse, Active DirectoryuserObject DeletedTrueFalse, Console user/group deleted, Console user/group deleted)

SafeNet DataSecure/KeySecure(이벤트 ID: Removed user)

Skyhigh Networks Cloud Security Platform(이벤트 ID: 10017)

Solaris BSM(이벤트 ID: delete user)

SonicWALL SonicOS(이벤트 ID: 559, 1157, 1158)

Trend Micro Deep Security(이벤트 ID: 651)

Universal DSM(이벤트 ID: Computer Account Removed, User Account Removed)

VMware vCloud Director(이벤트 ID: com/vmware/vcloud/event/user/remove, com/vmware/vcloud/event/user/delete)

Vormetric Data Security(이벤트 ID: DAO0090I)

iT-CUBE agileSI (EventID: AU8, U0)