mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 02:08:54 +00:00
29 lines
840 B
YAML
29 lines
840 B
YAML
title: Active Directory Kerberos DLL Loaded Via Office Applications
|
|
id: 7417e29e-c2e7-4cf6-a2e8-767228c64837
|
|
status: experimental
|
|
description: Detects Kerberos DLL being loaded by an Office Product
|
|
references:
|
|
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
|
|
author: Antonlovesdnb
|
|
date: 2020/02/19
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1193
|
|
logsource:
|
|
product: windows
|
|
service: sysmon
|
|
detection:
|
|
selection:
|
|
EventID: 7
|
|
Image:
|
|
- '*\winword.exe'
|
|
- '*\powerpnt.exe'
|
|
- '*\excel.exe'
|
|
- '*\outlook.exe'
|
|
ImageLoaded:
|
|
- '*\kerberos.dll'
|
|
condition: selection
|
|
falsepositives:
|
|
- Alerts on legitimate macro usage as well, will need to filter as appropriate
|
|
level: high
|