mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
423 B
YAML
16 lines
423 B
YAML
alert:
|
|
- debug
|
|
description: Detects non-system users failing to get a handle of the SCM database.
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.system.eventID:"4656" AND object_type:"SC_MANAGER\ OBJECT" AND object_name:"servicesactive" AND Keywords:"Audit\ Failure" AND SubjectLogonId:"0x3e4")
|
|
index: wazuh-alerts-3.x-*
|
|
name: 13addce7-47b2-4ca0-a98f-1de964d1d669_0
|
|
priority: 1
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|