This commit is contained in:
Pete Bryan 2021-04-22 11:31:26 -07:00
Родитель e42a3e2770
Коммит 603816bcd0
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -29,7 +29,7 @@ query: |
// Where changes relate to Exchange OAB
| extend ObjectClass = column_ifexists("ObjectClass", "")
| where ObjectClass =~ "msExchOABVirtualDirectory"
// Look for AttributeLDAPDisplayName or ExternalHostName properties being changed
// Look for InternalHostName or ExternalHostName properties being changed
| extend AttributeLDAPDisplayName = column_ifexists("AttributeLDAPDisplayName", "")
| where AttributeLDAPDisplayName in ("msExchExternalHostName", "msExchInternalHostName")
// Look for suspected webshell activity