From 56bb35279f470fc2f488b17b93e819a74c58d811 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Mon, 29 Aug 2022 12:46:30 -0400 Subject: [PATCH] Update get_domainuser_with_powershell_script_block.yml Making fields consistent, replaced user_id with UserID to match extracted field type, and make it match other detections. A cosmetic change. --- .../endpoint/get_domainuser_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index c3f3fe2e49..1bb71060d2 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'