[WINDOWS-SYSMON] Nltest Discovery Commands

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Nltest Discovery Commands"; program:*Sysmon*
| *Security*; event_id:1,4688; meta_content:"nltest %sagan%",/domain_trusts,/all_trusts; meta_nocase; meta_content:!"User
| 3a
| NT AUTHORITY\%sagan%",SYSTEM,NETWORK,LOCAL; meta_nocase; reference:url,thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/; classtype:trojan-activity; sid:5013879; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0007, mitre_technique_id T1087;)