Update proc_creation_win_susp_network_command.yml

Added route print
2022-04-11 13:36:52 -04:00
parent 869535be95
commit 162d577523
1 changed files with 1 additions and 0 deletions
@@ -17,6 +17,7 @@ detection:
            - 'arp -a'
            - 'nbtstat -n'
            - 'net config'
+            - 'route print'
    condition: network_cmd
 falsepositives:
    - Administrator, hotline ask to user