From cbe0d73ce87fa89da6be90d9cd9801787bed8cbf Mon Sep 17 00:00:00 2001 From: root Date: Sat, 26 Oct 2019 20:06:02 +0200 Subject: [PATCH] add win_susp_dxcap.yml --- rules/windows/process_creation/win_susp_dxcap.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/win_susp_dxcap.yml b/rules/windows/process_creation/win_susp_dxcap.yml index 3fb6272ad..afd02da5c 100644 --- a/rules/windows/process_creation/win_susp_dxcap.yml +++ b/rules/windows/process_creation/win_susp_dxcap.yml @@ -1,6 +1,6 @@ title: Bypassing Application Whitelisting by using dxcap.exe status: experimental -description: Local execution of a process as a subprocess of Dxcap.exe +description: Local execution of a process as a subprocess of Dxcap.exe references: - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml - https://twitter.com/harr0ey/status/992008180904419328