security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update del related detection (#4046)

Browse Source
This commit is contained in:
Gude5
2023-02-27 15:19:28 +01:00
committed by GitHub
parent 46ed735d4a
commit 39928d2cdf
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_cmd_delete.yml
+4 -1
View File
@@ -9,7 +9,7 @@ references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
author: frack113
date: 2022/01/15
modified: 2022/08/20
modified: 2023/02/24
tags:
- attack.defense_evasion
- attack.t1070.004
@@ -21,6 +21,9 @@ detection:
- CommandLine|contains|all:
- ' del '
- /f
- CommandLine|contains|all:
- ' del '
- /s
- CommandLine|contains|all:
- rmdir
- /s