CmdID

CmdID / Commands

groupdel

Delete existing user groups from the system. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Delete an existing group

sudo groupdel group_nameIdentify

Trips 1 Sigma rule: mediumGroup Has Been Deleted Via Groupdel by Tuan Le (NCSGroup)

What detects it

Sigma process creation rules that name groupdel
mediumGroup Has Been Deleted Via GroupdelTuan Le (NCSGroup)