atomic-threat-coverage/detection_rules/win_susp_add_sid_history.yml
2019-02-12 04:55:11 +01:00

22 lines
531 B
YAML
Executable File

title: Addition of SID History to Active Directory Object
status: stable
description: An attacker can use the SID history attribute to gain additional privileges.
references:
- https://adsecurity.org/?p=1772
author: Thomas Patzke
tags:
- attack.privilege_escalation
- attack.t1178
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4765
- 4766
condition: selection
falsepositives:
- Migration of an account into a new domain
level: medium