logs-system[.]securityDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 7 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Managing Elastic Security Detection Rules with Terraform“The data will be written by the Elastic Agent into the system.security Data Stream, we can match it with this index pattern: logs-system[.]security-*.”
-
Katz and Mouse Game: MaaS Infostealers Adapt to Patched Chrome Defenses“FROM logs-system[.]security-default* | where event.code == "4663" and winlog.event_data.ObjectName == "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{708860E0-F641-4611-8895-7D867DD3675B}" and not winlog.event_data.ProcessName in ("C:\\Program Files\\Google\\Chrome\\Application\\c…”
Indicators reported together
named in the same reports- system[.]securityin 1 report
- hxxps://blog.quest[.]com/10-microsoft-service-account-best-practices/in 1 report
- blog.quest[.]comin 1 report
- security-rules[.]tfin 1 report
- 27e4a3627d7df2b2…8fadb66cf23din 1 report
- 08d9d4e6489dc5b0…d094eac6cb37in 1 report
- 43cb70d31daa43d2…80cf710f9b1din 1 report
- 84033def9ffa70c7…fd8474fb8176in 1 report
- b74733d68e95220a…1e465ba9299bin 1 report
- hxxps://developer.chrome[.]com/release-notes/127in 1 report
- hxxps://security.googleblog[.]com/2024/07/improving-security-of-chrome-cookies-on.htmlin 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2023-36025
Thanks — we review every report.