Anvilogic critical experimental other

Account Password Changed from Command Line - Windows [snowflake-crowdstrikefdr_process]

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. This use case detects commands involving the use of net.exe to change account passwords. Atomics T1531 Test #1

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and regexp_like(process, '.*net1?(\\\.exe)?\\\s+user\\\s+\\\S+\\\s+\\\S+.*', 'i') and not regexp_like(process, '.*\\\/\\\S+.*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...