admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating Analytic Story

Browse Source
This commit is contained in:
dluxtron
2022-09-21 09:09:34 +10:00
parent 5f958fa1e5
commit dee4f1b672
3 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/windows_domain_controller_attacks.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-08-29'
author: Dean Luxton, Mauricio Velazco
description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques.
narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network.
Featuring attacks which leverage flaws within replication (read MS probably won’t fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques.
Featuring attacks which leverage flaws within replication [MS probably won’t fix these any time soon], enabling backdoor accounts and other stealthy persistence techniques.
It is imperative to enable the necessary GPOs and SACLs required - otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging.
references:
- https://adsecurity.org/?p=1929
tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml → tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml
View File
tests/experimental/rogue_dc_network_activity.test.yml → tests/experimental/network/rogue_dc_network_activity.test.yml
View File