From 5d54e9c8a163b334e9ad55edd98ed42f9c679dae Mon Sep 17 00:00:00 2001 From: Yugoslavskiy Daniil Date: Mon, 11 Mar 2019 19:28:29 +0100 Subject: [PATCH] nbstat.exe -> nbtstat.exe --- rules/windows/process_creation/win_multiple_suspicious_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/win_multiple_suspicious_cli.yml b/rules/windows/process_creation/win_multiple_suspicious_cli.yml index d4237c788..2be4cda9c 100644 --- a/rules/windows/process_creation/win_multiple_suspicious_cli.yml +++ b/rules/windows/process_creation/win_multiple_suspicious_cli.yml @@ -19,7 +19,7 @@ detection: - hostname.exe - ipconfig.exe - mimikatz.exe - - nbstat.exe + - nbtstat.exe - net.exe - netsh.exe - nslookup.exe