Merge pull request #3928 from jkb-s/patch-2

Fix `filepath` parameter
This commit is contained in:
Nasreddine Bencherchali
2023-01-16 11:10:01 +01:00
committed by GitHub
@@ -7,7 +7,7 @@ references:
- https://docs.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
author: Nasreddine Bencherchali
date: 2022/09/09
modified: 2022/12/29
modified: 2023/01/16
tags:
- attack.defense_evasion
- attack.t1553.004
@@ -18,7 +18,7 @@ detection:
selection:
CommandLine|contains|all:
- 'Import-Certificate'
- ' -File-Path '
- ' -FilePath '
- 'Cert:\LocalMachine\Root'
CommandLine|contains:
- '\AppData\Local\Temp\'