Skip to content

[Rule Tuning] Enumeration of Privileged Local Groups Membership #2046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jun 30, 2022
Merged

[Rule Tuning] Enumeration of Privileged Local Groups Membership #2046

merged 3 commits into from
Jun 30, 2022

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Jun 20, 2022

Issues

Resolves #2024

Summary

Adds WaAppAgent.exe as an exception.

Description from Msdocs:

RD Agent Service: This service is responsible for the Installation of Guest Agent. Transparent Installer is also a component of Rd Agent that helps to upgrade other components and services of Guest Agent. RD Agent is also responsible for sending heartbeats from Guest VM to Host Agent on the physical server.

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint labels Jun 20, 2022
@w0rk3r w0rk3r self-assigned this Jun 20, 2022
terrancedejesus
terrancedejesus approved these changes Jun 20, 2022
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this @w0rk3r. LGTM!

Mikaayenson
Mikaayenson approved these changes Jun 24, 2022
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Good work!

@w0rk3r w0rk3r merged commit 853f8db into main Jun 30, 2022
@w0rk3r w0rk3r deleted the groupenum_azguest branch June 30, 2022 17:26
protectionsmachine pushed a commit that referenced this pull request Jun 30, 2022
@w0rk3r @github-actions
Update discovery_privileged_localgroup_membership.toml (#2046)
8011420 
(cherry picked from commit 853f8db)
protectionsmachine pushed a commit that referenced this pull request Jun 30, 2022
@w0rk3r @github-actions
Update discovery_privileged_localgroup_membership.toml (#2046)
a9f1633 
(cherry picked from commit 853f8db)
protectionsmachine pushed a commit that referenced this pull request Jun 30, 2022
@w0rk3r @github-actions
Update discovery_privileged_localgroup_membership.toml (#2046)
1b77431 
(cherry picked from commit 853f8db)
protectionsmachine pushed a commit that referenced this pull request Jun 30, 2022
@w0rk3r @github-actions
Update discovery_privileged_localgroup_membership.toml (#2046)
7f4e03b 
(cherry picked from commit 853f8db)
protectionsmachine pushed a commit that referenced this pull request Jun 30, 2022
@w0rk3r @github-actions
Update discovery_privileged_localgroup_membership.toml (#2046)
95feaf0 
(cherry picked from commit 853f8db)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@Samirbous Samirbous Samirbous approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Enumeration of Privileged Local Groups Membership
4 participants
@w0rk3r @Mikaayenson @Samirbous @terrancedejesus