User Account Deleted Via userdel
Detects the execution of the 'userdel' binary, which is used to delete a user account and associated files. This activity can be abused by threat actors to remove accounts, hindering forensic analysis and covering their tracks.
Sigma
