security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: broken links

Browse Source
This commit is contained in:
Florian Roth
2020-07-03 11:22:06 +02:00
parent 3111ab8396
commit 5f04fcccf5
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/sysmon_cmstp_execution.yml
+1 -1
View File
@@ -12,7 +12,7 @@ tags:
author: Nik Seetharaman
date: 2018/07/16
references:
- http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
- https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
fields:
- CommandLine
- ParentCommandLine
rules/windows/process_creation/win_cmstp_com_object_access.yml
+1 -1
View File
@@ -16,7 +16,7 @@ author: Nik Seetharaman
modified: 2019/07/31
date: 2019/01/16
references:
- http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
- https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
- https://twitter.com/hFireF0X/status/897640081053364225
logsource:
category: process_creation
rules/windows/registry_event/sysmon_cmstp_execution.yml
+1 -1
View File
@@ -12,7 +12,7 @@ tags:
author: Nik Seetharaman
date: 2018/07/16
references:
- http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
- https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
fields:
- CommandLine
- ParentCommandLine
rules/windows/sysmon/sysmon_cmstp_execution.yml
+1 -1
View File
@@ -12,7 +12,7 @@ tags:
author: Nik Seetharaman
date: 2018/07/16
references:
- http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
- https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
detection:
condition: 1 of them
fields: