Anvilogic high experimental spl

Account set to active via Net.exe [splunk-edr]

Adversaries may obtain and abuse credentials of a default or disabled account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. -- Threat Actor Association: Unfading Sea Haze - Software Association: RansomHub -- Atomics T1078.001 Test#1 Atomics T1078.001 Test#2 Atomics T1564 Test#2

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) 
OR (TERM(ProcessRollup2) 
OR Type=Process) 
OR TERM(DeviceProcessEvents)) ("/active:yes" 
OR "/active:y")
| table _time, host, user, signature_id, process, process_*, parent_process_*, src_ip, dest_ip, dest_port `group_events("host", 1)` `hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...