mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
642 B
YAML
16 lines
642 B
YAML
alert:
|
|
- debug
|
|
description: Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger.
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.eventdata.targetFilename.keyword:*\\Local\\Microsoft\\Windows\\SchCache\\*.sch AND (NOT (data.win.eventdata.image:("C\:\\windows\\system32\\svchost.exe" OR "C\:\\windows\\system32\\dllhost.exe" OR "C\:\\windows\\system32\\mmc.exe" OR "C\:\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe" OR "C\:\\Windows\\CCM\\CcmExec.exe"))))
|
|
index: wazuh-alerts-3.x-*
|
|
name: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb_0
|
|
priority: 2
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|