Update MSRPRN_Printer_Bug_Exploitation.yaml
This commit is contained in:
Родитель
410fee42e2
Коммит
fdf9cd34f6
|
@ -4,7 +4,6 @@ description: |
|
|||
'This query detects potential attempts to remotely access to the print spooler service on Active Directory Domain Controllers which could indicate an exploitation of MS-RPRN printer bug from a server that is configured with unconstrained delegation.
|
||||
This query searches for the event id 5145 on Domain Controllers where the ShareName is "\\\*\IPC$" and the RelativeTargetName is "spoolss".
|
||||
Ref: https://medium.com/@riccardo.ancarani94/exploiting-unconstrained-delegation-a81eabbd6976#:~:text=The%20exploitation%20of%20unconstrained%20delegation,system%20with%20the%20delegation%20enabled.&text=but%20before%20doing%20that%20we,listen%20for%20incoming%20authenticated%20connections.'
|
||||
severity: High
|
||||
requiredDataConnectors:
|
||||
- connectorId: SecurityEvents
|
||||
dataTypes:
|
||||
|
|
Загрузка…
Ссылка в новой задаче