// [T1087.002] Account Discovery - Domain Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/002/
//
// This identifies Linux PR2 events referencing ldapsearch. 

#event_simpleName=ProcessRollup2 
| event_platform=Lin ImageFileName=/.*\/ldapsearch/i
| select([timestamp, aid, UserSid, ParentBaseFileName, ImageFileName, CommandLine])
| sort(field=timestamp, order=asc, limit=10000)
| timestamp := formatTime("%Y-%m-%d %H:%M:%S", field=timestamp, locale=en_US, timezone=Z)