From cbec7b274ecd9fcdbe331c4b14c70af5cb498c67 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Sat, 9 Apr 2022 20:02:34 +0200 Subject: [PATCH] Update proc_creation_win_susp_vaultcmd.yml --- .../process_creation/proc_creation_win_susp_vaultcmd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/proc_creation_win_susp_vaultcmd.yml b/rules/windows/process_creation/proc_creation_win_susp_vaultcmd.yml index 463d2b936..df9664b18 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_vaultcmd.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_vaultcmd.yml @@ -1,4 +1,4 @@ -title: Access Saved Credentials via VaultCmd +title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: experimental description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe