Update win_alert_ad_user_backdoors.yml

2020-05-19 14:50:22 +02:00
parent c815773b1a
commit 9ab65cd1c7
1 changed files with 1 additions and 3 deletions
@@ -22,9 +22,7 @@ detection:
    filter_null:
        AllowedToDelegateTo: null
    filter1:
-        AllowedToDelegateTo: 
-            - null
-            - '-'
+        AllowedToDelegateTo: '-'
    selection2:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'