Fixes spelling mistake of success (missing a c)
This commit is contained in:
@@ -2,8 +2,9 @@ title: Privileged Account Creation
|
||||
id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947
|
||||
status: experimental
|
||||
description: Detects when a new admin is created.
|
||||
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
|
||||
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton
|
||||
date: 2022/08/11
|
||||
modified: 2022/08/16
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts
|
||||
logsource:
|
||||
@@ -14,7 +15,7 @@ detection:
|
||||
properties.message|contains|all:
|
||||
- Add user
|
||||
- Add member to role
|
||||
Status: Sucess
|
||||
Status: Success
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- A legitmate new admin account being created
|
||||
|
||||
Reference in New Issue
Block a user