10 lines
240 B
YAML
10 lines
240 B
YAML
|
title: Suspicious Admin Login
|
||
|
|
id: AB-DR-001
|
||
|
|
status: test
|
||
|
|
description: Detects admin login containing 'admin' in username
|
||
|
|
logsource: { product: auth }
|
||
|
|
detection:
|
||
|
|
selection: { username|contains: admin }
|
||
|
|
condition: selection
|
||
|
|
level: medium
|