Update sysmon_abusing_debug_privilege.yml

NT AUTHORITY\SYSTEM
2020-10-26 14:56:25 +03:00
parent 3ff10b160f
commit cb5a541a5e
1 changed files with 1 additions and 1 deletions
@@ -28,7 +28,7 @@ detection:
            - '\powershell.exe'
            - '\cmd.exe'
    selection3:
-            User: 'NT AUTHORITY\\SYSTEM'
+            User: 'NT AUTHORITY\SYSTEM'
    filter:
           CommandLine|contains|all:
           - ' route ADD '