mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
minor fixes
This commit is contained in:
+2
-2
@@ -7,10 +7,10 @@ type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`,
|
||||
to identify an unusual number of computer service tickets request from one source. When a domain joined endpoint connects
|
||||
to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects
|
||||
to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint
|
||||
requesting a large number of computer service tickets for different endpoints could represent malicious behavior like
|
||||
lateral movement, malware staging, reconoissance, etc.\
|
||||
lateral movement, malware staging, reconnaissance, etc.\
|
||||
|
||||
The detection calculates the standard deviation for each host and leverages the
|
||||
3-sigma statistical rule to identify an unusual number of service requests. To customize this
|
||||
|
||||
+2
-2
@@ -7,9 +7,9 @@ type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`,
|
||||
to identify an unusual number of remote authentication atttemps coming from one source. An endpoint
|
||||
to identify an unusual number of remote authentication attempts coming from one source. An endpoint
|
||||
authenticating to a large number of remote endpoints could represent malicious behavior like
|
||||
lateral movement, malware staging, reconoissance, etc.\
|
||||
lateral movement, malware staging, reconnaissance, etc.\
|
||||
|
||||
The detection calculates the standard deviation for each host and leverages the
|
||||
3-sigma statistical rule to identify an unusual high number of authentication events. To customize this
|
||||
|
||||
Reference in New Issue
Block a user