kqlElastic-2.0from elastic/detection-rules
Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml
event.code:4704 and host.os.type:"windows" and winlog.event_data.PrivilegeList:"SeEnableDelegationPrivilege"