adding 4742 detection

detections/detect_computer_changed_with_anonymous_account.yml

@@ -0,0 +1,33 @@
+name: Detect Computer Changed with Anonymous Account
+id: 1400624a-d42d-484d-8843-e6753e6e3645
+version: 1
+date: '2020-09-18'
+description: This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account.
+how_to_implement: This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+type: ESCU
+references:
+- https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
+author: Rod Soto, Jose Hernandez, Splunk
+search: '`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3
+| stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user
+| `detect_computer_changed_with_anonymous_account_filter`'
+known_false_positives: None thus far found
+tags:
+  analytics_story:
+  - Detect Zerologon Attack
+  mitre_attack_id:
+  - T1210
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 6
+  - CIS 8
+  nist:
+  - DE.AE
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Windows