fix: wpad decision matches
This commit is contained in:
@@ -3,7 +3,7 @@ id: d88d0ab2-e696-4d40-a2ed-9790064e66b3
|
||||
description: Detects the modification of the registry settings used for Internet Explorer and other Windows components that use these settings
|
||||
author: frack113
|
||||
date: 2022/01/22
|
||||
modified: 2022/03/25
|
||||
modified: 2022/03/29
|
||||
status: experimental
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
|
||||
@@ -25,6 +25,7 @@ detection:
|
||||
TargetObject|contains:
|
||||
- '\Cache'
|
||||
- '\ZoneMap'
|
||||
- '\WpadDecision'
|
||||
filter_binary:
|
||||
Details: 'Binary Data'
|
||||
condition: selection_domains and not 1 of filter_*
|
||||
|
||||
Reference in New Issue
Block a user