topic How to write a Search to detect AD DSRM persistence? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Search-to-detect-AD-DSRM-persistence/m-p/597067#M207835 <P>Hi All,<BR /><BR />Has anybody implemented a search to detect the following use case ?<BR /><A href="https://adsecurity.org/?p=1785" target="_blank" rel="noopener">https://adsecurity.org/?p=1785</A>&nbsp;<BR /><BR />Any suggestions how to write the query will be highly appreciated.&nbsp; We are getting AD logs in with all the necessary auditing enabled.<BR /><BR /></P> Tue, 10 May 2022 14:10:24 GMT neerajs_81 2022-05-10T14:10:24Z How to write a Search to detect AD DSRM persistence? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Search-to-detect-AD-DSRM-persistence/m-p/597067#M207835 <P>Hi All,<BR /><BR />Has anybody implemented a search to detect the following use case ?<BR /><A href="https://adsecurity.org/?p=1785" target="_blank" rel="noopener">https://adsecurity.org/?p=1785</A>&nbsp;<BR /><BR />Any suggestions how to write the query will be highly appreciated.&nbsp; We are getting AD logs in with all the necessary auditing enabled.<BR /><BR /></P> Tue, 10 May 2022 14:10:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Search-to-detect-AD-DSRM-persistence/m-p/597067#M207835 neerajs_81 2022-05-10T14:10:24Z