This commit is contained in:
Ashwin Patil 2020-12-23 11:33:03 -08:00
Родитель fd821d64a1
Коммит 6492e63a4b
1 изменённых файлов: 2 добавлений и 2 удалений

Просмотреть файл

@ -23,13 +23,13 @@ relevantTechniques:
- T1069
- T1074
query: |
let stardate = 14d;
let startdate = 14d;
let lookupwindow = 2m;
let threshold = 3;
let tokens = dynamic(["-b","-f","-h","gcb","-sc","-subnets","objectcategory","domainlist","dcmodes","adinfo","trustdmp","computers_pwdnotreqd"]);
SecurityEvent
//| where Computer in (DCADFSServersList) // limit it to your DC/ADFS servers list or any pattern in hostnames.
| where TimeGenerated between (ago(stardate)..now())
| where TimeGenerated between (ago(startdate)..now())
| where EventID == "4688"
| where tolower(CommandLine) has_any (tokens)
| where CommandLine matches regex "(.*)>(.*)"