Classification:

attack

Tactic:

TA0040-impact

Technique:

T1531-account-access-removal

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful deletion of admin user accounts or roles in Zscaler Internet Access (ZIA). Alerts when any administrator successfully deletes an existing account or role in the ZIA console.

Strategy

This rule monitors ZIA audit logs for OCSF Account Change events (@ocsf.class_uid is 3001) where the activity is a delete operation (@ocsf.activity_id is 6) and the result is successful (@ocsf.status_id is 1). Removing an admin account or role is a high-impact operation that can be used by an attacker to cover their tracks, remove a competing admin’s access, or disable another responder’s ability to intervene during an incident. Because any successful deletion warrants analyst review, the rule alerts on the first matching event per administrator within the 24-hour evaluation window (additional events by the same administrator within that window are grouped into the same signal). The administrator performing the deletion is captured in @ocsf.actor.user.name and the deleted entity in @ocsf.user.name.

Triage and Response

• Verify whether {{@ocsf.actor.user.name}} is authorized to delete admin accounts or roles in ZIA and whether this action was expected.
• Review the identity and role of the deleted account or role ({{@ocsf.user.name}}) to determine what level of access was removed and who it belonged to.
• Check recent activity from {{@ocsf.actor.user.name}} in ZIA audit logs to identify any other privileged actions taken around the same time, such as other account changes or policy modifications.
• Determine if a change management ticket or offboarding request exists that corresponds to this deletion.
• Confirm with the owner of the deleted account (if known) that the removal was expected, especially if it occurred outside a routine offboarding process.
• If the deleted account belonged to another administrator, verify that responder was not deliberately locked out during an active incident.