Merge PR #4636 from @slincoln-aiq - Fix Typo In Enable LM Hash Storage - ProcCreation

fix: Enable LM Hash Storage - ProcCreation - Removed trailing slash from registry path
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
This commit is contained in:
Stephen Lincoln
2023-12-21 21:03:32 -05:00
committed by GitHub
parent e052677142
commit e0cf5f3bdc
@@ -13,6 +13,7 @@ references:
- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023/12/15
modified: 2023/12/22
tags:
- attack.defense_evasion
- attack.t1112
@@ -22,7 +23,7 @@ logsource:
detection:
selection:
CommandLine|contains|all:
- '\System\CurrentControlSet\Control\Lsa\'
- '\System\CurrentControlSet\Control\Lsa'
- 'NoLMHash'
- ' 0'
condition: selection