admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor

Browse Source
This commit is contained in:
patel-bhavin
2021-07-26 18:40:35 -07:00
parent 6278d12ded
commit df4b290340
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/sam_database_file_access_attempt.yml
+1 -1
View File
@@ -3,7 +3,7 @@ id: 57551656-ebdb-11eb-afdf-acde48001122
version: 1
date: '2021-07-23'
author: Michael Haag, Mauricio Velazco, Splunk
type: batch
type: Hunting
datamodel:
- Endpoint
description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database.