Elastic low stable eql

User Added to the Admin Group

Identifies users being added to the admin group. This could be an indication of privilege escalation activity.

View Source

Detection Logic

configuration where host.os.type == "macos" and event.type == "change" and
  event.action == "od_group_add" and group.name:"admin"

Field Validations

Loading…

Comments (0)

Loading comments...