MITRE ATT&CK Tactic
Impact
2 queries tagged with this tactic.
View on MITRE ATT&CK →
-
Identity
Who Deleted An AD User
Who deleted an AD user (`SecurityEvent` EventID `4726`) over the last 90 days.
-
Identity
Who Removed A User From Group Chat
Teams-related removal actions performed by a specific user in the last 7 days, from `OfficeActivity` / Unified Audit Log.