From 4cd4ff3085533d4e65efabe364fd1880ccf92225 Mon Sep 17 00:00:00 2001 From: Ricardo Dias Date: Sat, 30 Nov 2019 00:57:06 +0000 Subject: [PATCH] updated kerberos entity names --- detection_data_model/user-object-relationships.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detection_data_model/user-object-relationships.md b/detection_data_model/user-object-relationships.md index 86eed3cd4..8a799e7da 100644 --- a/detection_data_model/user-object-relationships.md +++ b/detection_data_model/user-object-relationships.md @@ -1,12 +1,12 @@ | ATT&CK Data Source | Sub Data Source | Source Data Object | Relationship | Destination Data Object | EventID | | ----------------- | --------------- | ------------------ | ------------ | --------------------- | ------- | | Process use of network | process network connection allow | user | connected_to | ip | 3 | -| Windows event logs | kerberos TGT request | user | requested | ticket granting ticket | 4768 | -| Windows event logs | kerberos TGT request | user | requested | ticket granting ticket | 4768 | -| Windows event logs, Authentication logs | kerberos TGT authentication failure | user | authenticated_with | ticket granting ticket | 4771 | -| Windows event logs | kerberos service ticket request | user | requested | service ticket | 4769 | -| Windows event logs | kerberos service ticket renewal | user | renewed | service ticket | 4770 | -| Windows event logs | kerberos service ticket failure | user | requested | service ticket | 4773 | +| Windows event logs | kerberos TGT request | user | requested | kerberos_tgt | 4768 | +| Windows event logs | kerberos TGT request | user | requested | kerberos_tgt | 4768 | +| Windows event logs, Authentication logs | kerberos TGT authentication failure | user | authenticated_with | kerberos_tgt | 4771 | +| Windows event logs | kerberos service ticket request | user | requested | kerberos_tgs | 4769 | +| Windows event logs | kerberos service ticket renewal | user | renewed | kerberos_tgs | 4770 | +| Windows event logs | kerberos service ticket failure | user | requested | kerberos_tgs | 4773 | | Windows event logs | user rdp session | user | disconnected_from | host | 4779 | | Windows event logs | user rdp session | user | connected_to | host | 4778 | | Windows event logs | user lock operation | user | locked | host | 4800 |