LoFP LoFP / t1531

t1531

TitleTags
accounts may legitimately leave an organization during company splits, divestitures, or other structural changes. this action requires the account's root credentials or an explicit policy granting `organizations:leaveorganization`. any unexpected event, successful or denied, should be treated as a critical incident requiring immediate investigation and confirmation with account/organization owners.
an rds security group deletion may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
authorized infrastructure teardown automation may legitimately invoke these commands. correlate with change management records and known deployment pipeline identities before escalating.
automated processes using tools like terraform may trigger this alert.
aws accounts may be legitimately closed as part of organizational restructuring, account consolidation, or decommissioning of workloads. legitimate closures should always have a corresponding change-management record and documented approval; any closure without one should be treated as a critical incident.
deletions by unfamiliar users should be investigated. if the behavior is known and expected, it can be exempted from the rule.
developers who explicitly instruct an agent to tear down a development environment or rotate access keys will trigger this rule. confirm intent with the user before escalating.
google workspace admin roles may be deleted by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.
if the behavior of revoking okta api tokens is expected, consider adding exceptions to this rule to filter false positives.
legitimate administrative actions by authorized system administrators could cause this alert. verify the user identity, user agent, and hostname to ensure they are expected.
legitimate administrator activities
legitimate group deletion during decommissioning of projects, clean-up of service accounts, or identity lifecycle changes may trigger this alert. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. resource group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
legitimate remote account administration.
mfa device deactivation may occur legitimately during device rotation, user offboarding, or troubleshooting. for example, aws requires deactivation of an existing mfa device before adding a replacement. these actions are often performed by administrators following approved change-control processes. to reduce false positives, validate whether the deactivation aligns with a documented workflow, known device replacement, or expected maintenance window. if performed outside of expected operational hours, by an unexpected user, or from an unfamiliar source ip, this event should be investigated for potential credential compromise or unauthorized tampering.
mfa policies may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.
planned tenant offboarding, sandbox teardown, or contract termination can produce these events. confirm the actor and timing against change management or offboarding records before escalating.
platform and security teams delete admin api keys during scheduled rotation or decommissioning. check for a nearby `admin_api_key_created` event or an approved change ticket to explain the deletion.
role deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. role deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
service account being disabled or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
service account being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
service account disabled or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
service account key deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. key deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
service account modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
service accounts may be deleted by system administrators. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.
service accounts may be disabled by system administrators. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.
unknown