Delete win_possible_dc_shadow.yml

2020-05-05 16:48:39 +02:00
parent e3f21805f3
commit db810b342f
1 changed files with 0 additions and 18 deletions
@@ -1,18 +0,0 @@
-title: Potential DCShadow
-description: Monitors SPN modifications to detect DCShadow behavior.
-author: Chakib Gzenayi (@Chak92), Hosni Mribah
-tags:
-    - attack.defense_evasion
-    - attack.t1207
-logsource:
-    product: windows
-    service: system
-detection:
-    selection:
-        EventID: 5136
-        LDAP_Display_Name: servicePrincipalName
-        Value: 'GC/*'
-    condition: selection
-falsepositives:
-    - Exclude known DCs
-level: high