Update proc_creation_win_sysmon_exploitation.yml

2022-12-30 09:00:57 +05:00
parent b97a7e0b0f
commit d7bc30587f
1 changed files with 2 additions and 1 deletions
@@ -8,7 +8,7 @@ references:
    - https://twitter.com/filip_dragovic/status/1590104354727436290
 author: Florian Roth
 date: 2022/11/10
-modified: 2022/12/15
+modified: 2022/12/30
 tag:
    - attack.privilege_escalation
    - attack.t1068
@@ -23,6 +23,7 @@ detection:
            - '\Sysmon64.exe'
    filter:
        - Image:
+            - 'C:\Windows\Sysmon.exe'
            - 'C:\Windows\Sysmon64.exe'
            - 'C:\Windows\System32\conhost.exe'
            - 'wevtutil.exe'