Create enrich-username-win.yaml

2025-03-04 21:12:02 +00:00
parent b22b5f2af3
commit afa5dbd141
1 changed files with 10 additions and 0 deletions
@@ -0,0 +1,10 @@
+# parsers/s02-enrich:
+name: custom/rdp-forbidden-usernames
+description: "Detect RDP login attempts with forbidden usernames"
+filter: "evt.Meta.event_id in ['4625']"
+grok:
+  pattern: "Account Name:\\s+(?P<username>\\S+)"
+  apply_on: message
+statics:
+  - meta: username
+    expression: evt.Parsed.username