Merge PR #4636 from @slincoln-aiq - Fix Typo In Enable LM Hash Storage - ProcCreation
fix: Enable LM Hash Storage - ProcCreation - Removed trailing slash from registry path --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
This commit is contained in:
@@ -13,6 +13,7 @@ references:
|
||||
- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
|
||||
author: Nasreddine Bencherchali (Nextron Systems)
|
||||
date: 2023/12/15
|
||||
modified: 2023/12/22
|
||||
tags:
|
||||
- attack.defense_evasion
|
||||
- attack.t1112
|
||||
@@ -22,7 +23,7 @@ logsource:
|
||||
detection:
|
||||
selection:
|
||||
CommandLine|contains|all:
|
||||
- '\System\CurrentControlSet\Control\Lsa\'
|
||||
- '\System\CurrentControlSet\Control\Lsa'
|
||||
- 'NoLMHash'
|
||||
- ' 0'
|
||||
condition: selection
|
||||
|
||||
Reference in New Issue
Block a user