Jump to content

YossiC

Members
 View Profile  See their activity

  • Posts

    5

  • Joined

  • Last visited

Kudos

1 Novice Reputation badge

See kudos

About YossiC

  • Rank
    Newbie
    Newbie

Profile Information

  • Location
    Israel

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1.    YossiC reacted to a post in a topic: Trigger event to Syslog
  2.    j91321 reacted to a post in a topic: Local Admin Additions
  3. YossiC
    Hi, Is it possible to send the Trigger Event of the Detection to Syslog? For example in rules catching SSH communication, the address would appear in the "Event" tab on Inspect console. My ESET Inspect server is on the latest version.
  4. YossiC
    Seems the rule is depednant on "Audit Security Group Management". Events are being recorded only after this is enabled.
  5. YossiC
    Can I send you this over PM? Thanks.
  6. YossiC
    Hi, Thank you for the reply. Yes, this is what I saw through ProcMon after posting this. I have tried testing the rule on my endpoint but it does not trigger. I also checked there are no exclusions related to this, or Events related to lsass.exe with UserAddToGroup operation.
  7. YossiC
    YossiC joined the community
  8. YossiC
    Hi guys, I'm trying to catch additions to the Local Admin group when it is done via mmc.exe, or PowerShell by anyone. The current rule "User added to Administrator group [F1000]" does not seem to trigger when it is done via mmc.exe. The only rule that does trigger is the Critical rule when the operation is done via the net command.
×
×
  • Create New...