Sagan informational stable other

[TENABLE] An administrator started impersonating another user

[TENABLE] An administrator started impersonating another user

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[TENABLE] An administrator started impersonating another user"; program:tenable_io_data; content:"
| 22
| action
| 22 3a 20 22
| user.impersonation.start
| 22
| "; classtype:system-event; reference:url,developer.tenable.com/reference/audit-log-events; sid:5010901; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...