Add Hex equivalent of WriteData

2021-05-19 10:27:20 -03:00
parent 18bbb2a342
commit 1cf7bb5735
1 changed files with 3 additions and 1 deletions
@@ -20,7 +20,9 @@ detection:
        EventID: 5145
        ShareName: \\*\SYSVOL
        RelativeTargetName|endswith: 'ScheduledTasks.xml'
-        Accesses|contains: 'WriteData'
+        Accesses|contains: 
+            - 'WriteData'
+            - '%%4417'
    condition: selection
 falsepositives:
    - if the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduledtasks