security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix modifier

Browse Source
This commit is contained in:
nasreddine.bencherchali@nextron-systems.com
2022-10-06 10:04:01 +02:00
parent d8c80d9193
commit 91cf9ce926
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/security/win_iso_mount.yml
+1 -1
View File
@@ -21,7 +21,7 @@ detection:
EventID: 4663
ObjectServer: 'Security'
ObjectType: 'File'
ObjectName|contains: '\Device\CdRom'
ObjectName|startswith: '\Device\CdRom'
filter:
ObjectName: '\Device\CdRom0\setup.exe'
condition: selection and not filter
rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml
+1 -1
View File
@@ -16,7 +16,7 @@ detection:
EventType: SetValue
TargetObject|endswith: '_Classes\mscfile\shell\open\command\(Default)'
filter:
Details|contains: '%SystemRoot%\system32\mmc.exe "%1" %'
Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %'
condition: selection and not filter
falsepositives:
- Unknown