Fix quoting for AD Object WriteDAC Access

The AccessMask field needs to be quoted so that it is compared correctly.
2020-06-22 15:31:03 -04:00
parent e2a16087c9
commit d385cbfa69
1 changed files with 1 additions and 1 deletions
@@ -16,7 +16,7 @@ detection:
    selection: 
        EventID: 4662
        ObjectServer: 'DS'
-        AccessMask: 0x40000
+        AccessMask: '0x40000'
        ObjectType:
            - '19195a5b-6da0-11d0-afd3-00c04fd930c9'
            - 'domainDNS'