Skip to content

Latest commit

 

History

History
30 lines (23 loc) · 814 Bytes

MATCH-S00859.md

File metadata and controls

30 lines (23 loc) · 814 Bytes

Rules: Zoom - Group Admin Deleted

Description

The Group admin deleted event is triggered every time one of your app users or account users delete a group admin.

Additional Details

Detail Value
Type Templated Match
Category Persistence
Apply Risk to Entities user_username
Signal Name Zoom - Group Admin Deleted - {{action}}
Summary Expression User: {{user_username}} {{action}}
Score/Severity Static: 1
Enabled by Default True
Prototype False
Tags _mitreAttackTactic:TA0003, _mitreAttackTechnique:T1098, _mitreAttackTactic:TA0040, _mitreAttackTechnique:T1531

Vendors and Products

Fields Used

Origin Field
Normalized Schema action
Normalized Schema listMatches
Normalized Schema metadata_vendor
Normalized Schema user_username