From 3b97ee423b0b8a3f3122a9cd63b57d46f1042363 Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Mon, 14 Feb 2022 12:11:12 -0300 Subject: [PATCH] Update discovery_net_command_system_account.toml (#1769) (cherry picked from commit c646a18efb0ede196ad02baa7f632ef7590347c0) --- rules/windows/discovery_net_command_system_account.toml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/windows/discovery_net_command_system_account.toml b/rules/windows/discovery_net_command_system_account.toml index d46deb290..1e8c80892 100644 --- a/rules/windows/discovery_net_command_system_account.toml +++ b/rules/windows/discovery_net_command_system_account.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/03/18" maturity = "production" -updated_date = "2021/09/23" +updated_date = "2022/02/10" [rule] author = ["Elastic"] @@ -23,7 +23,8 @@ type = "eql" query = ''' process where event.type in ("start", "process_started") and - user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and + (process.Ext.token.integrity_level_name : "System" or + winlog.event_data.IntegrityLevel : "System") and process.name : "whoami.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe") '''