added definition to Sysmon 13.30 rule for priv escalation

sec-js · Oct 27, 2021 · 7543b3e · 7543b3e
1 parent d80f736
commit 7543b3e
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/rules/windows/process_creation/win_susp_child_process_as_system_.yml b/rules/windows/process_creation/win_susp_child_process_as_system_.yml
@@ -17,11 +17,13 @@ modified: 2020/10/26
 logsource:
     category: process_creation
     product: windows
+    definition: ParentUser field needs sysmon >= 13.30
 detection:
     selection:
         ParentUser:
             - 'NT AUTHORITY\NETWORK SERVICE'
             - 'NT AUTHORITY\LOCAL SERVICE'
+            - 'AUTORITE NT\' # French language settings
         User:
             - 'NT AUTHORITY\SYSTEM'
             - 'AUTORITE NT\Sys' # French language settings