Issue on page /notebooks/windows/06_credential_access/WIN-180815210510.html

[damyanor]

Modification of query to exclude Azure sync via Azure AD Connect in hybrid environment.

[Cyb3rWard0g]

https://threathunterplaybook.com/notebooks/windows/05_defense_evasion/WIN-190101151110.html

[Cyb3rWard0g]

Thank you @damyanor ! Would you mind providing an example of the filter you are proposing? Is that something maybe that we can add under the playbook Hunter Notes section? Please and thank you!

[Cyb3rWard0g]

Oh something like this? : https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml#L23