Anvilogic high experimental other

Account Discovery Commands - Windows [snowflake-crowdstrikefdr_process]

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Atomics T1087.001 Test #8 Atomics T1087.001 Test #9 Atomics T1087.001 Test #10 Atomics T1087.002 Test #1 Atomics T1087.002 Test #2 Atomics T1087.002 Test #3 Atomics T1087.002 Test #9

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process, '.*((net(\\\.exe)?\\\s+(user
| group
| localgroup))
| query\\\s+user
| Get-(LocalGroupMember
| AdUser)).*', 'i') and not regexp_like(process, '.*\\\s+/(add
| delete).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...