Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/SeDebug_ProcessAccess_EQL

Created April 8, 2022 21:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/ef602a27d08fb966f4cceacb26cf1ddf to your computer and use it in GitHub Desktop.
Save Samirbous/ef602a27d08fb966f4cceacb26cf1ddf to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SeDebug_ProcessAccess_EQL
sequence by host.id with maxspan=5s
[any where event.code : "4703" and winlog.event_data.EnabledPrivilegeList:"SeDebugPrivilege"] by winlog.event_data.ProcessName
[process where event.code : "10" and not process.name in ("Procmon64.exe", "procexp64.exe")] by process.executable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment