Merge pull request #3147 from frack113/fix_issue_3067

Fix ServiceName
2022-06-19 15:03:43 +02:00
parent 5b38168340 55f1f6dd1e
commit f4ef4fcdc4
1 changed files with 2 additions and 2 deletions
@@ -10,7 +10,7 @@ tags:
 description: Detects service ticket requests using RC4 encryption type
 author: Florian Roth
 date: 2017/02/06
-modified: 2021/08/14
+modified: 2022/06/19
 logsource:
    product: windows
    service: security
@@ -20,7 +20,7 @@ detection:
        TicketOptions: '0x40810000'
        TicketEncryptionType: '0x17'
    reduction:
-        ServiceName|startswith: '$'
+        ServiceName|endswith: '$'
    condition: selection and not reduction
 falsepositives:
    - Service accounts used on legacy systems (e.g. NetApp)