From 1062a0bf93b98bff7e6cb65cb6d641747faeb802 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 14 Feb 2022 14:06:37 -0800 Subject: [PATCH] duplicates --- .../getwmiobject_ds_computer_with_powershell_script_block.yml | 4 ++-- .../getwmiobject_ds_group_with_powershell_script_block.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index 85d1f0325e..9c632db1d6 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace - root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace + root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 90cb20dc8b..2d3d5d7a09 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace - root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace + root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable