security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update sysmon_mimikatz_detection_lsass.yml

Browse Source
This commit is contained in:
yugoslavskiy
2019-11-07 04:33:40 +03:00
committed by GitHub
parent 92e09db9ab
commit 7affc09c19
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/sysmon/sysmon_mimikatz_detection_lsass.yml
+2 -2
View File
@@ -1,7 +1,7 @@
title: Mimikatz Detection LSASS Access
status: experimental
description: Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old versions", 0x0010 PROCESS_VM_READ)
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, oscd.community (update)
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (update)
date: 2017/02/16
modified: 2019/11/01
references:
@@ -43,4 +43,4 @@ detection:
condition: selection and not filter
falsepositives:
- Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
level: high
level: high