Merge pull request #569 from Neo23x0/devel

rule: improved bloodhound rule
2019-12-20 17:32:21 +01:00
parent cbebaf637f 0fa5ba925e
commit 1fd4c26005
1 changed files with 1 additions and 0 deletions
@@ -19,6 +19,7 @@ detection:
    selection2:
        CommandLine|contains: 
            - ' -CollectionMethod All '
+            - '.exe -c All -d '
            - 'Invoke-Bloodhound'
            - 'Get-BloodHoundData'
    selection3: