SigmaHQ/rules/windows/builtin/win_possible_dc_shadow.yml
2020-05-05 16:40:52 +02:00

19 lines
433 B
YAML

title: Potential DCShadow
description: Monitors SPN modifications to detect DCShadow behavior.
author: Chakib Gzenayi, Hosni Mribah
tags:
- attack.defense_evasion
- attack.t1207
logsource:
product: windows
service: system
detection:
selection:
EventID: 5136
LDAP_Display_Name: servicePrincipalName
Value: 'GC/*'
condition: selection
falsepositives:
- Exclude known DCs
level: high