Skip to content

groups.xml-user.md

Latest commit

 

History

History
31 lines (22 loc) · 874 Bytes

groups.xml-user.md

File metadata and controls

31 lines (22 loc) · 874 Bytes
Raw

groups.xml user

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/groups-xml-user | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: GroupsXmlUser

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
PASSWORD password string ✅
TYPE type string ✅
USER user string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "groups.xml user"

detection:
    selection:
        PASSWORD|contains: 'suspicious_string'
    condition: selection

level: medium