Update win_net_use_admin_share.yml
This commit is contained in:
@@ -4,11 +4,11 @@ status: experimental
|
||||
description: Detects when an admin share is mounted using net.exe
|
||||
references:
|
||||
- https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
|
||||
author: Teymur Kheirkhabarov '@HeirhabarovT', Zach Stanford '@svch0st'
|
||||
author: 'oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st'
|
||||
date: 2020/10/05
|
||||
tags:
|
||||
- attack.lateral_movement
|
||||
- attack.T1021.002
|
||||
- attack.t1021.002
|
||||
logsource:
|
||||
category: process_creation
|
||||
product: windows
|
||||
|
||||
Reference in New Issue
Block a user