Relevance - Windows Service logon account

Content Authoring
1

Hello…
I’m trying to nail down relevance for a Windows service, sshd, and if it is running under a domain service account, change the password. I have the password change scripted out in a powershell script but my relevance seems off.

First statement (filter down for Windows servers)
windows of operating system AND (if( name of operating system starts with “Win” ) then platform id of operating system != 3 else true)

Next statement (returns 234 servers)
exist service “sshd”

And here’s where i’m having trouble, when I add:
(login account of it as lowercase contains “domain\serviceaccount”) of service “sshd”

I’m only getting 2 servers back after adding the third relevance statement. I can run that locally and it looks good:
Q:(login account of it as lowercase =“domain\serviceaccount”) of service "sshd"
A: True
T: 95.974 ms

I’m missing something, hope someone can spot where i’m off.

Thanks!
Ted

2

Think I’ve answered my own question. I believe the relevance to be accurate. I’m still spot checking the larger list but I’m finding different service accounts running the service. I’ve also had a Tanium report pulled and it matches what this relevance returned.