security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update and rename posh_ps_copy_item_system32.yml to posh_ps_copy_item_system_directory.yml

Browse Source
This commit is contained in:
Qasim Qlf
2022-10-20 14:31:48 +05:00
committed by GitHub
parent ec3a371f51
commit 2c4ea3761a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_copy_item_system32.yml → rules/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml
+3 -3
View File
@@ -1,4 +1,4 @@
title: Powershell Install a DLL in System32
title: Powershell Install a DLL in System Directory
id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
status: experimental
description: Uses PowerShell to install/copy a a file into a system directory such as "System32" or "SysWOW64"
@@ -6,7 +6,7 @@ references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
author: frack113, Nasreddine Bencherchali
date: 2021/12/27
modified: 2022/07/07
modified: 2022/10/20
logsource:
product: windows
category: ps_script
@@ -26,4 +26,4 @@ falsepositives:
level: high
tags:
- attack.credential_access
- attack.t1556.002
- attack.t1556.002