security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2347 from redsand/sysmon_logon_scripts_userinitmprlogonscript_proc

Browse Source 
Sysmon logon scripts userinitmprlogonscript proc
This commit is contained in:
Florian Roth
2021-11-29 23:25:16 +01:00
committed by GitHub
parent 2da59406b7 422a579aca
commit 20b5c0bb5d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml
+2 -2
View File
@@ -6,7 +6,7 @@ author: Tom Ueltschi (@c_APT_ure)
references:
- https://attack.mitre.org/techniques/T1037/
date: 2019/01/12
modified: 2021/11/27
modified: 2021/11/29
logsource:
category: process_creation
product: windows
@@ -17,7 +17,7 @@ detection:
Image|endswith: '\explorer.exe'
exec_exclusion2:
CommandLine|contains:
- 'netlogon.bat'
- 'netlogon*.bat'
- 'UsrLogon.cmd'
create_keywords_cli:
CommandLine|contains: 'UserInitMprLogonScript'