security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'redcannary_20230113' of github.com:frack113/sigma into redcannary_20230113

Browse Source
This commit is contained in:
frack113
2023-01-13 13:03:52 +01:00
parent a0cc836d0a 23620bc8aa
commit 80be90c331
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_lsa_disablerestrictedadmin.yml
+1 -1
View File
@@ -24,7 +24,7 @@ detection:
CommandLine|contains|all:
- '\system\currentcontrolset\control\lsa'
- 'DisableRestrictedAdmin'
- ' 0'
- ' 1'
condition: selection
falsepositives:
- Unknown