The SIEM app is now a part of the Elastic Security solution.
Click
here to view SIEM documentation for previous releases.
Permission Theft - Detected - Elastic Endpoint Security
editPermission Theft - Detected - Elastic Endpoint Security
editElastic Endpoint Security detected Permission Theft. Click the Elastic Endpoint Security icon in the event.module column or the link in the rule.reference column for additional information.
Rule type: query
Rule indices:
- endgame-*
Severity: high
Risk score: 73
Runs every: 10 minutes
Searches indices from: now-15m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Endpoint
Version: 3 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 7.9.0
Rule authors: Elastic
Rule license: Elastic License
Rule query
editevent.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)
Rule version history
edit- Version 3 (7.9.0 release)
-
- Rule name changed from: Permission Theft - Detected - Elastic Endpoint
- Version 2 (7.7.0 release)
-
-
Updated query, changed from:
event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:detection
-