From 89bbee65944203520d0dbe96c3c5ed2ca84841ac Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Fri, 16 Oct 2020 11:57:54 -0300 Subject: [PATCH] Update win_susp_service_dacl_modification.yml --- .../process_creation/win_susp_service_dacl_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/win_susp_service_dacl_modification.yml b/rules/windows/process_creation/win_susp_service_dacl_modification.yml index eaa1529af..82f5e0f35 100644 --- a/rules/windows/process_creation/win_susp_service_dacl_modification.yml +++ b/rules/windows/process_creation/win_susp_service_dacl_modification.yml @@ -1,7 +1,7 @@ title: Suspicious Service DACL Modification id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 description: Detects suspicious DACL modifications that can be used to hide services or make them unstopable -author: Jonhnathan Ribeiro +author: Jonhnathan Ribeiro, oscd.community status: experimental date: 2020/10/16 references: