kqlElastic-2.0from elastic/detection-rules
Delegated Managed Service Account Modification by an Unusual User
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml
event.code:5136 and host.os.type:"windows" and winlog.event_data.AttributeLDAPDisplayName:"msDS-ManagedAccountPrecededByLink"