← Library
kqlElastic-2.0from elastic/detection-rules

Modification of the msPKIAccountCredentials

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1068T1098
Rule sourcerules/windows/privilege_escalation_credroaming_ldap.toml
event.code:"5136" and host.os.type:"windows" and winlog.event_data.AttributeLDAPDisplayName:"msPKIAccountCredentials" and
  winlog.event_data.OperationType:"%%14674" and
  not winlog.event_data.SubjectUserSid : "S-1-5-18"