Added password flag
This commit is contained in:
@@ -11,7 +11,7 @@ logsource:
|
||||
detection:
|
||||
selection:
|
||||
Image: 'schtasks.exe'
|
||||
CommandLine: '*/change*/TN*/RU*'
|
||||
CommandLine: '*/change*/TN*/RU*/RP*'
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Unknown
|
||||
|
||||
Reference in New Issue
Block a user