9 lines
240 B
YAML
9 lines
240 B
YAML
title: Suspicious Admin Login
|
|
id: AB-DR-001
|
|
status: test
|
|
description: Detects admin login containing 'admin' in username
|
|
logsource: { product: auth }
|
|
detection:
|
|
selection: { username|contains: admin }
|
|
condition: selection
|
|
level: medium
|