Entra ID Successful Group Deletion
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
YARA-L
