get_logon_rights_modifications_for_endpoint.yml

name: Get Logon Rights Modifications For Endpoint
id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505
version: 2
date: '2017-09-12'
author: David Dorsey, Splunk
type: Investigation
status: deprecated
description: This search allows you to retrieve any modifications to logon rights
  associated with a specific host.
search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$
  | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right,
  signature'
how_to_implement: To successfully implement this search you must be ingesting your
  Windows event logs
known_false_positives: ''
references: []
tags:
  analytic_story:
  - AWS Cryptomining
  product:
  - Splunk Phantom
  security_domain: endpoint