Rule fixes

2018-06-27 18:47:52 +02:00
parent 9705366060
commit a61052fc0a
2 changed files with 2 additions and 2 deletions
@@ -12,7 +12,7 @@ logsource:
 detection:
    selection1:
        EventID: 4738
-        AllowedToDelegateTo: '*'
+        AllowedToDelegateTo: (any)
    selection2:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'
@@ -27,4 +27,4 @@ fields:
    - ParentCommandLine
 falsepositives:
    - Will need to be tuned. If using Splunk, I recommend | stats count by Computer,CommandLine following the search for easy hunting by computer/CommandLine.
-level: medium
+level: low