Open damyanor opened 2 years ago
Modification of query to exclude Azure sync via Azure AD Connect in hybrid environment.
https://threathunterplaybook.com/notebooks/windows/05_defense_evasion/WIN-190101151110.html
Thank you @damyanor ! Would you mind providing an example of the filter you are proposing? Is that something maybe that we can add under the playbook Hunter Notes section? Please and thank you!
Hunter Notes
Oh something like this? : https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml#L23
Modification of query to exclude Azure sync via Azure AD Connect in hybrid environment.