From e125a4e4cf6f6d67daa8076a4c259ed02bc9dd3f Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Mon, 8 Apr 2024 08:43:25 -0300 Subject: [PATCH] [Rule Tuning] WRITEDAC Access on Active Directory Object (#3583) --- .../defense_evasion_write_dac_access.toml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules_building_block/defense_evasion_write_dac_access.toml b/rules_building_block/defense_evasion_write_dac_access.toml index da0f2028a..ddd47f1ea 100644 --- a/rules_building_block/defense_evasion_write_dac_access.toml +++ b/rules_building_block/defense_evasion_write_dac_access.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2024/04/08" [rule] author = ["Elastic"] @@ -17,7 +17,7 @@ lateral movement, and persistence. """ from = "now-119m" interval = "60m" -index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] +index = ["winlogbeat-*", "logs-system.security*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "WRITEDAC Access on Active Directory Object" @@ -49,8 +49,8 @@ type = "query" building_block_type = "default" query = ''' -event.action:"Directory Service Access" and event.code:"5136" and - winlog.event_data.AccessMask:"0x40000" +host.os.type: "windows" and event.action : ("Directory Service Access" or "object-operation-performed") and + event.code : "4662" and winlog.event_data.AccessMask:"0x40000" ''' [[rule.threat]]