Elastic Defend high stable eql
Kerberos Config File Accessed by Osascript
Identifies the Osascript process accessing the Kerberos configuration file. Adversaries may attempt to access this file in order to gain situational awareness regarding the Active Directory domain to include its structure and settings.
Detection Logic
file where event.action == "open" and
file.path like "/etc/krb5.conf" and
process.name == "osascript"Field Validations
Loading…
Comments (0)
Loading comments...