Rules Contributing to Suspicious Activity Related to Security-Enabled Group Alerts

The following rules are used to identify suspicious activity related to security-enabled group. Any one or more of these will trigger suspicious Activity Related to Security-Enabled Group Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Security-Enabled Universal Group was Created

A Security-Enabled Universal Group has been created. This could be an indication of malicious activity.

Security-Enabled Global Group was Created

A Security-Enabled Global Group has been created. This could be an indication of malicious activity.

Member Added to Security-Enabled Universal Group

A member was added to a Security-Enabled Universal Group. This could be an indication of malicious activity.

Security-Enabled Local Group was Created

A Security-Enabled Local Group has been created. This could be an indication of malicious activity.

Security-Enabled Local Group was Deleted

A Security-Enabled Local Group has been deleted. This could be an indication of malicious activity.

Security-Enabled Universal Group was Deleted

A Security-Enabled Universal Group has been deleted. This could be an indication of malicious activity.

Security-Enabled Global Group was Deleted

A Security-Enabled Global Group has been deleted. This could be an indication of malicious activity.