[New Rule] Enumeration of Users or Groups using Built-In Commands

[Samirbous]

Description

EQL:

process where event.type in ("start", "process_started") and
 (process.name in ("ldapsearch", "dsmemberutil")) or
 (process.name == "dscl" and process.args:("read", "-read", "list", "-list", "ls") and process.args:("/Active Directory/*", "/Users*", "/Groups*"))

Required Info

• Eventing Sources:

• Target Operating Systems:

• Platforms

• Target ECS Version: x.x.x
• New fields required in ECS for this?
• Related issues or PRs

Optional Info

• References:

Example Data