security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rename ftp.exe rule to lolbin rule

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-11-10 17:06:28 +01:00
parent c102b26bcf
commit 14d13ef9ac
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_ftp.yml → rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml
+1 -1
View File
@@ -1,4 +1,4 @@
title: Suspicious Execution Of FTP.EXE Binary
title: LOLBIN Execution Of The FTP.EXE Binary
id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e
status: test
description: Detects execution of ftp.exe script execution with the "-s" flag and any child processes ran by ftp.exe