All Detections

Unauthorized Account Creation or Deletion Detection

avatar
Subash Ghimire@iamsubashg
updated Aug 20, 20251041

Identifies unauthorized user account creation or deletion attempts by checking against a list of approved users in the IdentityDirectoryEvents.

Microsoft Sentinel (KQL)