Update enumerate_users_local_group_using_telegram.yml

detections/endpoint/enumerate_users_local_group_using_telegram.yml

@@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect a suspicious telegram process that enumerate
-  all network user in a local group. This technique was seen in monero infected honeypot
-  to mapped all the users in the compromised machine
+description: This analytic will detect a suspicious Telegram process enumerating
+  all network users in a local group. This technique was seen in a Monero infected honeypot
+  to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device.
 search: '`wineventlog_security` EventCode=4798  Process_Name = "*\\telegram.exe" |
   stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode
   Process_Name  Process_ID Account_Name Account_Domain Logon_ID Security_ID Message
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the task schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
+  logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
   filter known instances of process like logonUI used in your environment.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
 tags:
   analytic_story:
   - xmrig