Hayabusa high test sigma

Operation Wocao Activity - Security

Detects activity mentioned in Operation Wocao report

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4799,
    "TargetUserName
| startswith": "Administr",
    "CallerProcessName
| endswith": "\\checkadmin.exe"
  },
  "condition": "security and selection"
}

False Positives

  • ⚠ Administrators that use checkadmin.exe tool to enumerate local administrators

Field Validations

Loading…

Comments (0)

Loading comments...