security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update reg

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-08-05 12:29:36 +01:00
parent d259f9400e
commit a50b35cdfa
2 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml
+1 -3
View File
@@ -23,9 +23,7 @@ detection:
current_version_keys:
TargetObject|contains:
- '\ShellServiceObjectDelayLoad'
- '\Run\'
- '\RunOnce\'
- '\RunOnceEx\'
- '\Run' # Covers the following keys: 'Run', 'RunOnce', 'RunServices', 'RunServicesOnce', 'RunOnceEx'
- '\Policies\System\Shell'
- '\Policies\Explorer\Run'
- '\Group Policy\Scripts\Startup'
rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
+1 -3
View File
@@ -23,9 +23,7 @@ detection:
wow_current_version_keys:
TargetObject|contains:
- '\ShellServiceObjectDelayLoad'
- '\Run\'
- '\RunOnce\'
- '\RunOnceEx\'
- '\Run' # Covers the following keys: 'Run', 'RunOnce', 'RunServices', 'RunServicesOnce', 'RunOnceEx'
- '\Explorer\ShellServiceObjects'
- '\Explorer\ShellIconOverlayIdentifiers'
- '\Explorer\ShellExecuteHooks'