-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathSuspicious Account Activity.xml
126 lines (121 loc) · 16.1 KB
/
Suspicious Account Activity.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
<?xml version="1.0" encoding="utf-8" ?>
<!--
==============================================================================
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.
$Workfile: Suspicious Account Activity.xml $
$Revision: 0 $
$Modtime: 7/14/2019 10:33:22 PM $
==============================================================================
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
==============================================================================
-->
<ITRTProcessingRule original_parent="\Configuration\Objects\{F81E88B8-5629-4698-AEB7-38731A4B1520}\RuleGroups\{28FA8433-6EEB-45DC-9C11-7E97D9BCC2DD}\Rules">
<LimitEventsCount>10</LimitEventsCount>
<SuppressBySeverity>0</SuppressBySeverity>
<Description></Description>
<GenerateAlert>1</GenerateAlert>
<AlertInitialState>0</AlertInitialState>
<Name>Suspicious Account Activity</Name>
<Guid>{F844550B-81B9-47EB-AAD5-7E0ED133ED30}</Guid>
<MatchCondition>01000000000800003C00720075006C006500200074007900700065003D002200520045004C0022002000760065007200730069006F006E003D00220031002E00300022003E000D000A003C0061007200670075006D0065006E00740073003E000D000A0009003C0021002D002D000D000A0009000900500072006F007600690064006500200063006F006E0066006900670075007200610062006C0065002000720075006C006500200061007200670075006D0065006E0074007300200068006500720065002E000D000A000900090009004500610063006800200061007200670075006D0065006E00740020006D00750073007400200062006500200070006C0061006300650064002000770069007400680069006E0020003C0061007200670075006D0065006E0074003E0020007400610067002C000D000A0009000900090065002E0067002E003A000D000A0009000900090009003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D002200530061006D0070006C006500200061007200670075006D0065006E007400220020006E0061006D0065003D002200530061006D0070006C006500200061007200670075006D0065006E00740022003E000D000A00090009000900090009003C00760061006C00750065003E00530061006D0070006C006500200061007200670075006D0065006E0074002000760061006C00750065003C002F00760061006C00750065003E000D000A0009000900090009003C002F0061007200670075006D0065006E0074003E000D000A0009002D002D003E000D000A00090009003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D002200540069006D006500200070006500720069006F006400220020006E0061006D0065003D002200540069006D006500200070006500720069006F006400220020006400650073006300720069007000740069006F006E003D002200540069006D006500200070006500720069006F006400200069006E00200077006800690063006800200074006800650020006500760065006E007400730020006F0063006300750072007200650064002E002200200063006C006100730073003D0022004400610074006500540069006D006500520061006E006700650022003E000D000A000900090009003C00760061006C00750065003E00220030002F00300030002F0030002000300030003A00310030003A003000300022003C002F00760061006C00750065003E000D000A00090009003C002F0061007200670075006D0065006E0074003E000D000A003C002F0061007200670075006D0065006E00740073003E000D000A0009003C0021002D002D000D000A00090009003C00700072006500660069006C007400650072003E00200061006E00640020003C0062006F00640079003E002000730065006300740069006F006E007300200063006F006E007400610069006E002000650078007000720065007300730069006F006E00730020007700720069007400740065006E00200069006E000D000A000900090009007400650072006D00730020006F00660020006500690074006800650072002000520045004C0020002800520075006C0065002000450078007000720065007300730069006F006E0020004C0061006E0067007500610067006500290020006F00720020004A006100760061005300630072006900700074000D000A000900090009006C0061006E0067007500610067006500200063006F006E0073007400720075006300740073002E000D000A000900090054006F0020007200650066006500720065006E0063006500200061007200670075006D0065006E0074002000700072006F0076006900640065006400200069006E0020003C0061007200670075006D0065006E00740073003E002000730065006300740069006F006E0020007700690074006E0069006E000D000A000900090009003C00700072006500660069006C007400650072003E00200061006E00640020003C0062006F00640079003E002000730065006300740069006F006E0073002C00200075007300650020003C0070006100720061006D0065007400650072003E0020007400610067000D000A0009000900090065002E0067002E003A0020003C0070006100720061006D00650074006500720020006E0061006D0065003D002200530061006D0070006C006500200061007200670075006D0065006E007400220020002F003E000D000A000900090044006F0020006E006F007400200066006F007200670065007400200074006F0020007400650072006D0069006E00610074006500200063006F006E00740065006E007400730020006F006600200062006F00740068002000730065006300740069006F006E007300200077006900740068002000730065006D00690063006F006C006F006E0028003B0029002E000D000A00090009005400680065002000520045004C002000650078007000720065007300730069006F006E002000220074007200750065003B0022002C0020007700680069006300680020006D006100740063006800650073002000650078006100630074006C007900200061006C006C00200070006F0073007300690062006C00650020006500760065006E00740073000D000A0009000900090070006C006100630065006400200069006E00200062006F00740068002000730065006300740069006F006E0073002000620079002000640065006600610075006C0074002E000D000A0009002D002D003E000D000A003C00700072006500660069006C007400650072003E000D000A0009003C0021002D002D000D000A0009000900550073006500200074006800690073002000730065006300740069006F006E00200074006F002000730070006500630069006600790020006100670065006E0074002D0073006900640065002000660069006C00740065007200200066006F00720020007300650072007600650072002D00620061007300650064002000720075006C0065002E000D000A000900090059006F0075002000630061006E0020006F006D0069007400200074006800690073002000730065006300740069006F006E00200069006600200079006F007500200064006F0020006E006F007400200070006C0061006E00200074006F0020007500730065000D000A0009000900090074006800690073002000720075006C00650020006100730020007300650072007600650072002D0073006900640065002000720075006C0065002C0020006F007400680065007200770069007300650020007300700065006300690066007900200068006900670068002D0070007200650063006900730069006F006E000D000A00090009000900660069006C00740065007200200066006F007200200079006F00750072002000720075006C0065002E000D000A0009002D002D003E000D000A00090009003C0021002D002D000D000A00090009000900520045004C0020002D002000660069006C006C00200069006E0020006C006F0067006900630061006C002000650078007000720065007300730069006F006E0020007500730069006E006700200061006E0064002C0020006F0072002C00200063006F006D00700061007200690073006F006E0020006F00700065007200610074006F00720073002C000D000A0009000900090009006200750069006C0074002D0069006E002000660075006E006300740069006F006E00730020006500740063002E000D000A00090009002D002D003E000D000A0009000900090074007200750065003B000D000A00090009003C0021002D002D000D000A000900090009002F002F0020006A007300630072006900700074003A000D000A000900090009002F002F00090069006D0070006C0065006D0065006E00740020004F006E004500760065006E0074002000630061006C006C006200610063006B002000770068006900630068002000630061006C006C00730020006D0061007400630068002800290020007700680065006E006500760065007200200061007000700072006F00720069006100740065000D000A00090009000900660075006E006300740069006F006E0020004F006E004500760065006E0074002000280076006100720020006500760065006E00740029000D000A000900090009007B000D000A0009000900090009006900660020002800200031002000290009002F002F0020007200650070006C0061006300650020007700690074006800200073006F006D0065002000750073006500660075006C00200063006F006E0064006900740069006F006E000D000A00090009000900090009006D006100740063006800200028006500760065006E00740029003B000D000A000900090009007D000D000A00090009002D002D003E000D000A003C002F00700072006500660069006C007400650072003E000D000A003C0062006F00640079003E000D000A0028004500760065006E0074004900440020003D00200031003000310020006F00720020004500760065006E0074004900440020003D00200031003000340020006F00720020004500760065006E0074004900440020003D00200031003000350020006F00720020004500760065006E0074004900440020003D0020003100300037002900200061006E006400200063006F0075006E0074002800730065006C006500630074005F00660069006C0074006500720065006400280028004500760065006E0074004900440020003D00200031003000310020006F00720020004500760065006E0074004900440020003D00200031003000340020006F00720020004500760065006E0074004900440020003D00200031003000350020006F00720020004500760065006E0074004900440020003D00200031003000370029002C002000730074007200690065007100750028005A002E0043006F006D00700075007400650072002C00200043006F006D00700075007400650072002900200061006E0064002000730074007200690065007100750028005A002E0053007400720069006E00670031002C00200053007400720069006E006700310029002C0020003C0070006100720061006D00650074006500720020006E0061006D0065003D002200540069006D006500200070006500720069006F00640022002F003E00290029003D0020003100200061006E006400200065006D007000740079002800730065006C006500630074005F006D006100740063006800650073002800730074007200690065007100750028005A002E0043006F006D00700075007400650072002C00200043006F006D00700075007400650072002900200061006E0064002000730074007200690065007100750028005A002E0053007400720069006E00670031002C00200053007400720069006E006700310029002C0020003C0070006100720061006D00650074006500720020006E0061006D0065003D002200540069006D006500200070006500720069006F00640022002F003E00290029003B000D000A003C002F0062006F00640079003E000D000A003C002F00720075006C0065003E00</MatchCondition>
<AlertSeverity>64</AlertSeverity>
<Enabled>1</Enabled>
<SuppressByAlertCode>0</SuppressByAlertCode>
<Schedule>FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00</Schedule>
<VendorKnowledgeBase></VendorKnowledgeBase>
<ConditionType>{E00EE0F1-B3DF-4122-89B4-738EF5EC1C52}</ConditionType>
<SuppressByName>0</SuppressByName>
<AlertSuppression>0</AlertSuppression>
<CustomerKnowledgeBase></CustomerKnowledgeBase>
<Distribution></Distribution>
<AlertName>%RuleName%</AlertName>
<SuppressByRuleID>0</SuppressByRuleID>
<DoNotSaveEvents>0</DoNotSaveEvents>
<SuppressByHostName>0</SuppressByHostName>
<Condition></Condition>
<AlertComment></AlertComment>
<FilterCondition>0100000000000000</FilterCondition>
<AlertDescription><![CDATA[[Suspicous activity has been detected with account] | Computer:%event_1._HostName% |Source host:%event_1.String10%|User Account:%event_1.UserName%|Login Type:%event_1.String9%|Time:%event_1._LocalTime% ]]></AlertDescription>
<ScheduleEnabled>0</ScheduleEnabled>
<SuppressBySiteID>0</SuppressBySiteID>
<AlertAssignment></AlertAssignment>
<RuleDistribution>0</RuleDistribution>
<AlertCode>CU_--_---_####</AlertCode>
<SecurityDescriptor>
<SecurityDescriptor>
<Guid>{97B70588-A79D-4D7A-8CA6-4927F4F16722}</Guid>
<Inherit>true</Inherit>
<Owner>
<SID_Win>
<Value>S-1-5-21-1260426776-3623580948-1897206385-25142</Value>
<Guid>{DB7367AD-F36D-463F-BA6F-FE42BB9F66F3}</Guid>
</SID_Win>
</Owner>
</SecurityDescriptor>
</SecurityDescriptor>
<NotificationFormats>
<ITRTNotificationFormat>
<Guid>{750FE0D2-FDEC-4ADA-B715-F9B418DEF325}</Guid>
<ComposerTemplate>01000000F834885B1C14B949960CC37CE508B1D02200000049006E005400720075007300740020002500530065007600650072006900740079002500200061006C0065007200740020002D00200025004E0061006D00650025002E00050000007500740066002D0038001E0200005B005300750073007000690063006F0075007300200061006300740069007600690074007900200068006100730020006200650065006E0020006400650074006500630074006500640020007700690074006800200079006F007500720020006100630063006F0075006E0074005D000D000A000D000A0043006F006D00700075007400650072003A0020002000200020002000200020002000200020002000200020002000200020002000200025006500760065006E0074005F0031002E005700680065007200650025000D000A0053006F007500720063006500200048006F00730074003A0020002000200020002000200020002000200020002000200020002000200025006500760065006E0074005F0031002E00570068006500720065005F00460072006F006D0025000D000A00550073006500720020004100630063006F0075006E0074003A0020002000200020002000200020002000200020002000200025006500760065006E0074005F0031002E0055007300650072004E0061006D00650025000D000A004C006F00670069006E00200054007900700065003A002000200020002000200020002000200020002000200020002000200020002000200025006500760065006E0074005F0031002E004C006F0067006F006E005F00540079007000650025000D000A00540069006D0065003A0020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200025006500760065006E0074005F0031002E005700680065006E0025000D000A000D000A004900660020006900740020007700610073006E0027007400200079006F0075002C00200070006C006500610073006500200063006C00690063006B002000740068006500200066006F006C006C006F00770069006E00670020006C0069006E006B000D000A000D000A0068007400740070003A002F002F0073006500720076006900630065006E006F0077002E0063006F006D000D000A000D000A0049006600200069006E00200066006100630074002000690074002000770061007300200079006F0075002C00200079006F0075002000630061006E002000690067006E006F00720065002000740068006900730020006D006500730073006100670065000D000A000D000A00570068007900200064006F002000490020007300650065002000740068006900730020006D006500730073006100670065003F000D000A0068007400740070003A002F002F0074006900740061006E0063006F00720070002E006C006F00630061006C002F00690074006F00700073002F006100630063006F0075006E0074005F007500730065005F00610077006100720065006E006500730073000D000A000D000A00280054006900740061006E0043006F007200700020004900540020004F007000650072006100740069006F006E00730020007400650061006D002900</ComposerTemplate>
<ComposerId>{C40DBB2E-DF56-43AC-8392-EFB2D0DDCC5A}</ComposerId>
<Enabled>1</Enabled>
<NotificationType>{E01E93C2-938C-4BBD-88D9-0FD3B0E631E4}</NotificationType>
<SecurityDescriptor>
<SecurityDescriptor>
<Guid>{DF780144-EA13-4ED8-8696-447A08034378}</Guid>
<Inherit>true</Inherit>
<Owner>
<SID_Win>
<Value>S-1-5-21-1260426776-3623580948-1897206385-25142</Value>
<Guid>{513CA198-EFA9-45E6-9584-C0609A0B8B2C}</Guid>
</SID_Win>
</Owner>
</SecurityDescriptor>
</SecurityDescriptor>
</ITRTNotificationFormat>
</NotificationFormats>
<DataSources>
<ITRTRuleDataSource>
<Guid>{4FEA8AD9-7A6F-42A2-AEB2-BC148B6A57DD}</Guid>
<DataSourceId>{F7CDC04E-E96E-4A26-AEB3-A7D1440B602A}</DataSourceId>
<SecurityDescriptor>
<SecurityDescriptor>
<Guid>{9BDB3FBA-D03E-4713-BE38-DA45A4E177FE}</Guid>
<Inherit>true</Inherit>
<Owner>
<SID_Win>
<Value>S-1-5-21-1260426776-3623580948-1897206385-25142</Value>
<Guid>{36C98CFB-1D59-4B90-8F87-ED69B0231897}</Guid>
</SID_Win>
</Owner>
</SecurityDescriptor>
</SecurityDescriptor>
</ITRTRuleDataSource>
</DataSources>
<ResponseActions>
<ITRTResponseAction>
<ProviderConfig>01000000260000007B00410045004600410037003700350035002D0037004600440036002D0034003100350037002D0038003500380044002D003300330030004100360035004200370045003700310045007D0003000000260000007B00410037003800440032004400380044002D0044004200320032002D0034003600460043002D0041004600300035002D003400310033004200450033003600450032003100310030007D0013000000250061006C006500720074002E004400650073006300720069007000740069006F006E002500260000007B00410035003000350032004300310045002D0031003000440030002D0034004600410036002D0039004500420034002D004200340038004600340039003300300032003500380044007D000800000050004000730073007700300072006400260000007B00350038004400350034004600370042002D0031004300350039002D0034003400390043002D0038004400320035002D003800390036003800390041003300430032003300310038007D0037000000680074007400700073003A002F002F00640065007600360035003500370039002E0073006500720076006900630065002D006E006F0077002E0063006F006D002F006100700069002F006E006F0077002F007400610062006C0065002F0069006E0063006900640065006E007400</ProviderConfig>
<Guid>{1918F383-50CB-401B-9FF1-34CF46F8EE2C}</Guid>
<Timeout>0</Timeout>
<Distribution></Distribution>
<Enabled>1</Enabled>
<ProviderId>{E5D8E6C5-488A-42BF-B636-065E970F0067}</ProviderId>
<ExecutionOrder>0</ExecutionOrder>
<Destination>0</Destination>
<SecurityDescriptor>
<SecurityDescriptor>
<Guid>{50319CD5-F7E3-4D33-BCCC-5E27FC23A870}</Guid>
<Inherit>true</Inherit>
<Owner>
<SID_Win>
<Value>S-1-5-21-1260426776-3623580948-1897206385-25142</Value>
<Guid>{B5DEF650-E747-4499-B31D-FA82860772D4}</Guid>
</SID_Win>
</Owner>
</SecurityDescriptor>
</SecurityDescriptor>
</ITRTResponseAction>
</ResponseActions>
</ITRTProcessingRule>