security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3934 from phantinuss/master

Browse Source 
fix: FP found in testing environment
This commit is contained in:
Nasreddine Bencherchali
2023-01-19 17:13:02 +01:00
committed by GitHub
parent 9c40354075 df6d6107fc
commit 6c434edf54
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/proc_access_win_cred_dump_lsass_access.yml
+2 -1
View File
@@ -9,7 +9,7 @@ references:
- http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (update)
date: 2017/02/16
modified: 2022/12/05
modified: 2023/01/19
tags:
- attack.credential_access
- attack.t1003.001
@@ -80,6 +80,7 @@ detection:
GrantedAccess:
- '0x1410'
- '0x410'
- '0x1f3fff'
filter8:
SourceImage|endswith:
- '\thor.exe'