Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issue on page /notebooks/windows/06_credential_access/WIN-180815210510.html #52

Open
damyanor opened this issue Jan 31, 2022 · 3 comments
Open

Issue on page /notebooks/windows/06_credential_access/WIN-180815210510.html #52

damyanor opened this issue Jan 31, 2022 · 3 comments
Labels
playbook update

Comments

@damyanor
Copy link

Modification of query to exclude Azure sync via Azure AD Connect in hybrid environment.
@Cyb3rWard0g
Copy link
Collaborator

https://threathunterplaybook.com/notebooks/windows/05_defense_evasion/WIN-190101151110.html

@Cyb3rWard0g
Copy link
Collaborator

Thank you @damyanor ! Would you mind providing an example of the filter you are proposing? Is that something maybe that we can add under the playbook Hunter Notes section? Please and thank you!

@Cyb3rWard0g
Copy link
Collaborator

Oh something like this? : https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml#L23

@OTRF OTRF deleted a comment from emalise3 Sep 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
playbook update
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Cyb3rWard0g @damyanor