Group Deleted Via groupdel Command
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
Sigma
