@@ -7,7 +7,7 @@ references:
|
||||
- https://docs.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
|
||||
author: Nasreddine Bencherchali
|
||||
date: 2022/09/09
|
||||
modified: 2022/12/29
|
||||
modified: 2023/01/16
|
||||
tags:
|
||||
- attack.defense_evasion
|
||||
- attack.t1553.004
|
||||
@@ -18,7 +18,7 @@ detection:
|
||||
selection:
|
||||
CommandLine|contains|all:
|
||||
- 'Import-Certificate'
|
||||
- ' -File-Path '
|
||||
- ' -FilePath '
|
||||
- 'Cert:\LocalMachine\Root'
|
||||
CommandLine|contains:
|
||||
- '\AppData\Local\Temp\'
|
||||
|
||||
Reference in New Issue
Block a user