Revert "New Sigma rule detecting local user creation"

2019-04-21 09:09:25 +02:00
parent 49beb5d1a8
commit dd9648b31e
1 changed files with 0 additions and 25 deletions
@@ -1,25 +0,0 @@
-title: Detects local user creation
-description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows server logs and not on your DC logs. 
-status: experimental
-tags:
-    - attack.persistence
-    - attack.t1136
-references:
-    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ 
-author: Patrick Bareiss
-logsource:
-    product: windows
-    service: security
-detection:
-    selection:
-        EventID: 4720
-    condition: selection
-fields:
-    - EventCode
-    - Account_Name
-    - Account_Domain
-falsepositives: 
-    - Domain Controller Logs
-level: high
-
-