user_id

Author: patel-bhavin

detections/endpoint/windows_service_created_with_suspicious_service_name.yml

@@ -12,7 +12,7 @@ search: |-
   `wineventlog_system` EventCode=7045 
   | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID
   | eval process_name = mvindex(split(process,"\\"),-1)
-  | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user
+  | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id
   | lookup windows_suspicious_services service_name as object_name
   | where isnotnull(tool_name)
   | `security_content_ctime(firstTime)` 
@@ -44,7 +44,7 @@ rba:
   - field: dest
     type: system
     score: 75
-  - field: user
+  - field: user_id
     type: user
     score: 75
   threat_objects: