From c9099e8a41f725c51df19876dc82f992be37ed99 Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 2 Aug 2022 11:28:58 -0400 Subject: [PATCH] doing a fix to pass appcert --- detections/endpoint/potential_password_in_username.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index ee672b6ca4..6663127819 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime | lookup ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon - | eval incorrect_password=user + | eval incorrect_cred=user | eval endtime=endtime+1000 | map maxsearches=70 search="| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype @@ -29,10 +29,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` | `potential_password_in_username_false_positive_reduction` - | eval incorrect_password=\"$incorrect_password$\" + | eval incorrect_cred=\"$incorrect_cred$\" | eval ut_shannon=\"$ut_shannon$\" | sort count" - | where user!=incorrect_password + | where user!=incorrect_cred | outlier action=RM count | `potential_password_in_username_filter`' how_to_implement: To successfully implement this search, you need to have relevant @@ -92,4 +92,4 @@ tags: - Authentication.dest - sourcetype risk_score: 21 - security_domain: access \ No newline at end of file + security_domain: access