mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
506 B
YAML
16 lines
506 B
YAML
alert:
|
|
- debug
|
|
description: Detects activity as "net user administrator /domain" and "net group domain admins /domain"
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.system.eventID:"4661" AND data.win.eventdata.accessMask:"0x2d" AND ((object_type:"SAM_USER" AND object_name.keyword:S\-1\-5\-21\-*\-500) OR (object_type:"SAM_GROUP" AND object_name.keyword:S\-1\-5\-21\-*\-512)))
|
|
index: wazuh-alerts-3.x-*
|
|
name: 968eef52-9cff-4454-8992-1e74b9cbad6c_0
|
|
priority: 2
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|