security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1621 from leegengyu/patch-3

Browse Source 
Update sysmon_susp_pfx_file_creation.yml - Typo
This commit is contained in:
Florian Roth
2021-07-04 14:19:18 +02:00
committed by GitHub
parent 3d47fec2d8 a60a2feb17
commit 4de3378e5a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/file_event/sysmon_susp_pfx_file_creation.yml
+3 -3
View File
@@ -1,6 +1,6 @@
title: Suspicious PFX File Creation
id: dca1b3e8-e043-4ec8-85d7-867f334b5724
description: A General detection for processes creating PFX files. This could be an inidicator of an adversary exporting a local certificate to a pfx file.
description: A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.
status: experimental
date: 2020/05/02
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
@@ -18,5 +18,5 @@ detection:
TargetFilename|endswith: '.pfx'
condition: selection
falsepositives:
- unknown
level: medium
- System administrators managing certififcates.
level: medium