Archive

Correlation search for Interactive Login with Service Account and Interactive Login with Local Administrator

vikram1583
Explorer

Offense Name: Interactive Login with Service Account
Rule: Service accounts typically start with svc*

Offense Name: Interactive Login with Local Administrator
Rule: Local admin user is rs0

I want correlation search please

Tags (1)
0 Karma