Synopsis
SIEM Pull Service has detected via Splunk query that, on this Windows system, a user changed password.
Description
SIEM Pull Service has detected via Splunk query that, on this Windows system, a user changed password. The query used was (sourcetype="WinEventLog:Security" AND "Message=A user account was changed.") | regex "(Password\sLast\sSet:\s+\d+\/\d+\/\d+\s\d+\:\d+\:\d+\s)(AM|PM)"
