Security-Enabled Global Group Deletion
Detects when a security-enabled global group is deleted in a Windows environment. This activity can be indicative of an adversary attempting to remove traces of their presence or disrupt normal operations by deleting critical groups.
Sigma
