← Library
kqlElastic-2.0from elastic/detection-rules

dMSA Account Creation by an Unusual User

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1078T1078.002T1098T1136T1136.002
Rule sourcerules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml
event.code:5137 and host.os.type:"windows" and winlog.event_data.ObjectClass:"msDS-DelegatedManagedServiceAccount"