security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixing test

Browse Source
This commit is contained in:
Tim Shelton
2022-02-09 21:26:43 +00:00
parent d48b6beaf5
commit ae2c0f0a7f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/win_file_permission_modifications.yml
+2 -2
View File
@@ -19,13 +19,13 @@ detection:
CommandLine|contains: '/grant'
- Image|endswith: '\attrib.exe'
CommandLine|contains: '-r'
filter_1:
filter:
- CommandLine:
- 'C:\Windows\system32\cmd.exe /C ICACLS C:\ProgramData\dynatrace\gateway\config\config.properties /grant :r *S-1-5-19:F'
- 'C:\Windows\system32\cmd.exe /C ICACLS C:\ProgramData\dynatrace\gateway\config\connectivity.history /reset'
- 'ICACLS C:\ProgramData\dynatrace\gateway\config\config.properties /grant :r *S-1-5-19:F'
- 'ICACLS C:\ProgramData\dynatrace\gateway\config\connectivity.history /reset'
condition: selection and not 1 of filter*
condition: selection and not filter
fields:
- ComputerName
- User