security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update proc_creation_win_change_evtx_location.yml

Browse Source
This commit is contained in:
Vadim
2023-01-03 11:54:30 +03:00
committed by GitHub
parent e620fcbc0b
commit 2075962596
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_change_evtx_location.yml
+3 -4
View File
@@ -1,7 +1,7 @@
title: Process Creation Win Change Evtx Location
title: Change Evtx Location Used Wevtutil
id: e6b11ea9-919a-413a-92bd-0976b42bd3b8
status: experimental
description: Detects change location evtx used wecutil
description: Detects change location evtx used wevtutil
author: D3F7A5105
date: 2023/01/03
references:
@@ -21,8 +21,7 @@ detection:
- /lfn
- \.evtx
filter_cmd:
CommandLine|contains:
- \Windows\System32\winevt\Logs
CommandLine|contains: \Windows\System32\winevt\Logs
condition: selection_cmd and not filter_cmd
falsepositives:
- Admin activity