security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2740 from AndrewRathbun/master

Browse Source 
Update proc_creation_win_susp_esentutl_params.yml - minor spelling error
This commit is contained in:
frack113
2022-02-24 21:27:00 +01:00
committed by GitHub
parent e068695733 b17f2b3840
commit beafcc7b4c
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_esentutl_params.yml
+1 -1
View File
@@ -3,7 +3,7 @@ id: 7df1713a-1a5b-4a4b-a071-dc83b144a101
status: experimental
author: sam0x90
date: 2021/08/06
description: Conti recommendation to its affiliates to use esentult to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
description: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
references:
- https://twitter.com/vxunderground/status/1423336151860002816
- https://attack.mitre.org/software/S0404/