Create enrich-username-win.yaml

2025-03-04 21:12:02 +00:00
parent b22b5f2af3
commit afa5dbd141
1 changed files with 10 additions and 0 deletions
@@ -0,0 +1,10 @@
 # parsers/s02-enrich:
 name: custom/rdp-forbidden-usernames
 description: "Detect RDP login attempts with forbidden usernames"
 filter: "evt.Meta.event_id in ['4625']"
 grok:
  pattern: "Account Name:\\s+(?P<username>\\S+)"
  apply_on: message
 statics:
  - meta: username
    expression: evt.Parsed.username