From d2dcc579e8f905aa3e255ec2e2a3dcac7f94dca6 Mon Sep 17 00:00:00 2001 From: david-syk <128359288+david-syk@users.noreply.github.com> Date: Mon, 22 Sep 2025 12:15:35 +0200 Subject: [PATCH] Merge PR #5631 from @ david-syk - remove trailing slash update: RestrictedAdminMode Registry Value Tampering - ProcCreation - remove trailing slash --------- Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- .../proc_creation_win_reg_lsa_disable_restricted_admin.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml b/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml index a91d3bea2..3a4ec330b 100644 --- a/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml +++ b/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml @@ -14,7 +14,7 @@ references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: frack113 date: 2023-01-13 -modified: 2023-12-15 +modified: 2025-08-28 tags: - attack.defense-evasion - attack.t1112 @@ -24,7 +24,7 @@ logsource: detection: selection: CommandLine|contains|all: - - '\System\CurrentControlSet\Control\Lsa\' + - '\System\CurrentControlSet\Control\Lsa' - 'DisableRestrictedAdmin' condition: selection falsepositives: