detection.wiki

Detection rules › Panther

OneLogin Multiple Accounts Deleted

Severity
medium
Log types
OneLogin.Events
Tags
OneLogin, Impact:Account Access Removal
Reference
https://en.wikipedia.org/wiki/Denial-of-service_attack
Source
github.com/panther-labs/panther-analysis

Possible Denial of Service detected. Threshold for user account deletions exceeded.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1531 Account Access Removal

Rule body yaml

AnalysisType: rule
Filename: onelogin_threshold_accounts_deleted.py
RuleID: "OneLogin.ThresholdAccountsDeleted"
DisplayName: "OneLogin Multiple Accounts Deleted"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Impact:Account Access Removal
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0040:T1531
Description: >
  Possible Denial of Service detected. Threshold for user account deletions exceeded.
Threshold: 10
DedupPeriodMinutes: 10
Reference: https://en.wikipedia.org/wiki/Denial-of-service_attack
Runbook: Determine if this is normal user-cleanup activity.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: Normal User Activated Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": "16",
        "actor_user_id": 654321,
        "actor_user_name": " Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User Account Delete Event
    ExpectedResult: true
    Log:
      {
        "event_type_id": "17",
        "actor_user_id": 654321,
        "actor_user_name": " Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }

Detection logic

Condition

event_type_id eq "17"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
event_type_ideq
  • 17

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
actor_user_name