get_logon_rights_modifications_for_user.yml

name: Get Logon Rights Modifications For User
id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb
version: 2
date: '2019-02-27'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search allows you to retrieve any modifications to logon rights
  for a specific user account.
search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$
  | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right,
  signature'
how_to_implement: To successfully implement this search you must be ingesting your
  Windows event logs
known_false_positives: ''
references: []
tags:
  analytic_story:
  - AWS Cryptomining
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - signature_id
  - dest
  - user
  security_domain: endpoint