valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix invalid field EventID 5136

Browse Source
This commit is contained in:
frack113 2021-07-06 15:25:32 +02:00
parent bcf2bf2e4d
commit bbf908835e
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/builtin/win_possible_dc_shadow.yml
View File

@ -4,6 +4,7 @@ description: Detects DCShadow via create new SPN
status: experimental
author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
date: 2019/10/25
modified: 2021/07/06
references:
- https://github.com/Neo23x0/sigma/blob/ec5bb710499caae6667c7f7311ca9e92c03b9039/rules/windows/builtin/win_dcsync.yml
- https://twitter.com/gentilkiwi/status/1003236624925413376
@ -21,8 +22,8 @@ detection:
ServicePrincipalNames|contains: 'GC/'
selection2:
EventID: 5136
LDAPDisplayName: servicePrincipalName
Value|startswith: 'GC/'
AttributeLDAPDisplayName: servicePrincipalName
AttributeValue|startswith: 'GC/'
condition: selection1 OR selection2
falsepositives:
- Exclude known DCs