Added Sigma mapping for certificateservicesclient-lifecycle-system (#…

…3223)
google · Nov 28, 2024 · 4379ca2 · 4379ca2
1 parent c49ec7e
commit 4379ca2
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/data/sigma_config.yaml b/data/sigma_config.yaml
@@ -78,6 +78,11 @@ logsources:
     product: windows
     conditions:
       data_type: "windows:evtx:record"
+  service_windows_certificate_services:
+    service: certificateservicesclient-lifecycle-system
+    conditions:
+      source_name:
+        - "Microsoft-Windows-CertificateServicesClient-Lifecycle-System"
   service_windows_security:
     service: security
     conditions: