admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_powerview_ad_access_control_list_enumeration.yml

Browse Source
This commit is contained in:
mvelazco
2023-04-24 11:07:39 -04:00
parent e3139a9c90
commit 737d03ef76
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2023-04-20'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` and `Get-DomainObjectAcl`. This commandlets
description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets
are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within
the organizations network, such as domain controllers, users, groups, computers, shares, etc. Maintaining Active Directory permissions is complicated and hard to manage, especially in complex
and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged