LoFP LoFP / t1565.001

t1565.001

TitleTags
administrators may use wbadmin to restore files during approved recovery or testing activities. validate the users and context of the operation and apply additional filters as needed.
device or device configuration being modified or deleted may be performed by a system administrator.
device or device configuration modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
dns zone modification from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
dns zone modified and deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
legitimate administration activities
legitimate administrators may run these commands, though rarely.
some false positives are to be expected on user or administrator machines. apply additional filters as needed.