Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/hunt EoP via Service

Created September 18, 2023 15:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/e2b36544d7f78ebf13449d50ea47b0ec to your computer and use it in GitHub Desktop.
Save Samirbous/e2b36544d7f78ebf13449d50ea47b0ec to your computer and use it in GitHub Desktop.
Download ZIP
Raw
hunt EoP via Service
sequence by winlog.computer_name with maxspan=5m
[authentication where event.action == "logged-in" and
// non Elevated Token
winlog.event_data.ElevatedToken : "%%1843"] by winlog.event_data.TargetLogonId
[iam where event.action == "service-installed"] by winlog.event_data.SubjectLogonId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment