From 575f36d8f8193ff4840fbae2d02450a21491b7f7 Mon Sep 17 00:00:00 2001 From: Merlin Date: Wed, 19 Oct 2022 16:10:47 +0200 Subject: [PATCH] changed mitre id from process to user discovery --- .../powershell/powershell_script/posh_ps_as_rep_roasting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml b/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml index 6829f26a4..54cdd93a0 100644 --- a/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml +++ b/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml @@ -26,4 +26,4 @@ falsepositives: level: medium tags: - attack.discovery - - attack.t1057 + - attack.t1033