admin/hunters-forge-OSSEM
1
0
Fork 0
mirror of https://github.com/hunters-forge/OSSEM synced 2026-06-08 14:44:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated kerberos entity names

Browse Source
This commit is contained in:
Ricardo Dias
2019-11-30 00:57:06 +00:00
parent 42ecba4ed6
commit 4cd4ff3085
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_data_model/user-object-relationships.md
+6 -6
View File
@@ -1,12 +1,12 @@
| ATT&CK Data Source | Sub Data Source | Source Data Object | Relationship | Destination Data Object | EventID |
| ----------------- | --------------- | ------------------ | ------------ | --------------------- | ------- |
| Process use of network | process network connection allow | user | connected_to | ip | 3 |
| Windows event logs | kerberos TGT request | user | requested | ticket granting ticket | 4768 |
| Windows event logs | kerberos TGT request | user | requested | ticket granting ticket | 4768 |
| Windows event logs, Authentication logs | kerberos TGT authentication failure | user | authenticated_with | ticket granting ticket | 4771 |
| Windows event logs | kerberos service ticket request | user | requested | service ticket | 4769 |
| Windows event logs | kerberos service ticket renewal | user | renewed | service ticket | 4770 |
| Windows event logs | kerberos service ticket failure | user | requested | service ticket | 4773 |
| Windows event logs | kerberos TGT request | user | requested | kerberos_tgt | 4768 |
| Windows event logs | kerberos TGT request | user | requested | kerberos_tgt | 4768 |
| Windows event logs, Authentication logs | kerberos TGT authentication failure | user | authenticated_with | kerberos_tgt | 4771 |
| Windows event logs | kerberos service ticket request | user | requested | kerberos_tgs | 4769 |
| Windows event logs | kerberos service ticket renewal | user | renewed | kerberos_tgs | 4770 |
| Windows event logs | kerberos service ticket failure | user | requested | kerberos_tgs | 4773 |
| Windows event logs | user rdp session | user | disconnected_from | host | 4779 |
| Windows event logs | user rdp session | user | connected_to | host | 4778 |
| Windows event logs | user lock operation | user | locked | host | 4800 |