admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Xiao Lin
2020-10-22 11:07:58 +00:00
parent 1f51317037
commit 022ead83ff
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml
+2
View File
@@ -11,7 +11,9 @@ references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss]
author: Xiao Lin, Splunk
search: ' | from read_ssa_enriched_events()
| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID")
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID"
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD"
| select start_time, end_time, entities, body
| into write_ssa_detected_events(); '