security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: fix typo of lowercase Windows in description

Browse Source
This commit is contained in:
phantinuss
2023-06-21 09:52:29 +02:00
parent 6b2bf871c2
commit 6c4408ddff
35 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
+1 -1
View File
@@ -4,7 +4,7 @@ related:
- id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
type: derived
status: experimental
description: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the windows event logs
description: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs
references:
- https://twitter.com/oroneequalsone/status/1568432028361830402
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
+1 -1
View File
@@ -4,7 +4,7 @@ related:
- id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
type: similar
status: experimental
description: Detects attempts to remove windows defender configuration using the 'MpPreference' cmdlet
description: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet
references:
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
author: Nasreddine Bencherchali (Nextron Systems)
rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml
+1 -1
View File
@@ -4,7 +4,7 @@ related:
- id: ec19ebab-72dc-40e1-9728-4c0b805d722c
type: derived
status: experimental
description: Detects powershell scripts attempting to disable scheduled scanning and other parts of windows defender atp or set default actions to allow.
description: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps