Add User Account Password Changed Rules #809
Conversation
…d changes Signed-off-by: Darkrael <[email protected]>
…words changed by other accounts Signed-off-by: Darkrael <[email protected]>
…nges Signed-off-by: Darkrael <[email protected]>
There was a problem hiding this comment.
@Darkrael
Hi, thanks for the PR!
Could you change the title for the 4723 rule to: User Password Changed, and for the
4724 title: Password Reset By Admin?
I think this would be easier to understand the differences between these two events.
Also, in the description field that for 4724 event, write that The current password is not required to reset the password.
Also, please change the level to medium. Hayabusa will by default abbreviate this to med but we still use the original Sigma values in the rules.
Could you also mention in the description field how password resets can be abuse in attacks? (Like you mention in the issue).
If you have any good links to articles explaining those attacks, can you add the links to a references field?
Thanks!
…dium" and added details in "description" and added a "references" Signed-off-by: Darkrael <[email protected]>
…dded details to "description", changed "level" to medium and added "references" Signed-off-by: Darkrael <[email protected]>
|
Hey, thank you for looking at the merge request. I've changed everything you requested in the files and committed them. I've also retested them to make sure they work without any syntax errors |
Pull request to close #808.
I've tested it in a test environment and it worked as expected