diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index da70b9a2fd..c219db4001 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= potentially aiding in lateral movement or privilege escalation strategies. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 9f5a559909..9ebeba5c7c 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -14,7 +14,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= Active Directory. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 4a4e9d5b53..39af062361 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -13,7 +13,7 @@ description: This analytic utilizes PowerShell Script Block Logging (EventCode=4 Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 357ba5f839..13861b2523 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_local_admin_with_findlocaladminaccess_filter`'