Closed icthieves closed 3 years ago
oops, yes both should have a filter in the condition. good catch. I might have forgotten to add it. Good catch.
Would you mind opening a PR to update those two. I can always fix it in a PR too this weekend. Thank you for letting us know @icthieves !
Thank you @icthieves !
While reading the playbook page for Remote SCM handle failures, I noticed that while every SQL query on the page is filtering out SubjectLogonID 0x3e4, the Sigma rules appear to be inverted to only show results where SubjectLogonID=0x3e4, which from my understanding of the article seems to be backwards.
Both referenced Sigma rules are written this way: https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_scm_database_privileged_operation.yml and https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_scm_database_handle_failure.yml
Relevant snippet:
Possible change: