security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add related field

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2023-02-14 23:34:14 +01:00
parent 514eeb63fd
commit 8506dcaec8
2 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml
+3
View File
@@ -1,5 +1,8 @@
title: Service Reconnaissance Via Wmic.EXE
id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
related:
- id: 68bcd73b-37ef-49cb-95fc-edc809730be6
type: similar
status: experimental
description: |
An adversary might use WMI to check if a certain Remote Service is running on a remote device.
rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml
+2
View File
@@ -3,6 +3,8 @@ id: 68bcd73b-37ef-49cb-95fc-edc809730be6
related:
- id: 09658312-bc27-4a3b-91c5-e49ab9046d1b # PowerShell Variant
type: similar
- id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
type: similar
status: experimental
description: Detects known wmi recon method to look for unquoted service paths using wmic. Often used by pentesters and attackers enumeration scripts
references: