mdecrevoisier high experimental sigma

Account set with reversible encryption (weakness introduction)

Detects scenarios where an attacker set an account with reversible encryption to facilitate brutforce or cracking operations.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4738,
    "UserAccountControl": "%%2091"
  },
  "condition": "selection"
}

False Positives

  • ⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...