From 2e78d47992caf93b4a749905b4dd18dd53cd5d11 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Tue, 30 Aug 2022 12:48:10 -0400 Subject: [PATCH] Update adsisearcher_account_discovery.yml Modified the 4104 event to utilize XML event format vs Classic. --- detections/endpoint/adsisearcher_account_discovery.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index e9538f85fd..5118c3c397 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" - Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" + ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or