minor fixes

This commit is contained in:
mvelazco
2021-12-03 21:12:31 -05:00
parent 71410ddb7a
commit 20425018bc
2 changed files with 4 additions and 4 deletions
@@ -7,10 +7,10 @@ type: Hunting
datamodel:
- Endpoint
description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`,
to identify an unusual number of computer service tickets request from one source. When a domain joined endpoint connects
to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects
to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint
requesting a large number of computer service tickets for different endpoints could represent malicious behavior like
lateral movement, malware staging, reconoissance, etc.\
lateral movement, malware staging, reconnaissance, etc.\
The detection calculates the standard deviation for each host and leverages the
3-sigma statistical rule to identify an unusual number of service requests. To customize this
@@ -7,9 +7,9 @@ type: Hunting
datamodel:
- Endpoint
description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`,
to identify an unusual number of remote authentication atttemps coming from one source. An endpoint
to identify an unusual number of remote authentication attempts coming from one source. An endpoint
authenticating to a large number of remote endpoints could represent malicious behavior like
lateral movement, malware staging, reconoissance, etc.\
lateral movement, malware staging, reconnaissance, etc.\
The detection calculates the standard deviation for each host and leverages the
3-sigma statistical rule to identify an unusual high number of authentication events. To customize this