Josh Brower defensivedepth

## zeek_svcctl.yaml
title: Windows service changed or started remotely with svcctl
status: experimental
description: Detects when a Windows service has been changed or started with svcctl remotely (using DCE/RPC).
references:
    - https://github.com/juliourena/SharpNoPSExec
author: 'Josh Brower, @Defensivedepth'
logsource:
    product: zeek
    service: dce_rpc
detection:

## gist:748b1e8859c0559621eaeb30c3ea3322
event.dataset: "dce_rpc" |  groupby source.ip destination.ip event.module event.dataset dce_rpc.operation

## CIS-Benchmark-diff.py
# This script takes two CIS Benchmark PDFs as input and diffs them
# For example: It will generate a diff of the Win10 & W11 benchmarks

import fitz  # PyMuPDF
import re
import difflib
import sys
from datetime import datetime

def is_start_of_new_item(line):
	title: Windows service changed or started remotely with svcctl
	status: experimental
	description: Detects when a Windows service has been changed or started with svcctl remotely (using DCE/RPC).
	references:
	- https://github.com/juliourena/SharpNoPSExec
	author: 'Josh Brower, @Defensivedepth'
	logsource:
	product: zeek
	service: dce_rpc
	detection:
	# This script takes two CIS Benchmark PDFs as input and diffs them
	# For example: It will generate a diff of the Win10 & W11 benchmarks

	import fitz # PyMuPDF
	import re
	import difflib
	import sys
	from datetime import datetime

	def is_start_of_new_item(line):