security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update proc_creation_win_susp_esentutl_params.yml

Browse Source
This commit is contained in:
Andrew Rathbun
2022-02-24 11:52:21 -05:00
committed by GitHub
parent 2dc2b99714
commit b17f2b3840
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_esentutl_params.yml
+1 -1
View File
@@ -3,7 +3,7 @@ id: 7df1713a-1a5b-4a4b-a071-dc83b144a101
status: experimental
author: sam0x90
date: 2021/08/06
description: Conti recommendation to its affiliates to use esentult to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
description: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
references:
- https://twitter.com/vxunderground/status/1423336151860002816
- https://attack.mitre.org/software/S0404/