win_security_ad_replication_non_machine_account

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.