Revert "Create win_susp_replace_lolbin.yml"

This reverts commit e6a6549676.
2020-10-16 09:10:48 -03:00
parent 5e9c80c8b1
commit e47bee2d4e
1 changed files with 0 additions and 25 deletions
@@ -1,25 +0,0 @@
-title: Ingress Tool Transfer Using Replace.exe
-id: 6ccf0c00-1061-4195-a724-6d9c0058b036
-description: Detect Copy and Download operations using Replace.exe.
-status: experimental
-references:
-  - https://lolbas-project.github.io/lolbas/Binaries/Replace
-author: Jonhnathan Ribeiro, oscd.community
-date: 2020/10/07
-tags:
-  - attack.command_and_control
-  - attack.t1105
-logsource:
-  category: process_creation
-  product: windows
-detection:
-  selection:
-    Image|endswith:
-      - '\replace.exe'
-    CommandLine|contains:
-      - "\\\\\\\\"
-      - "/A"
-  condition: selection
-falsepositives:
-  - Legitimate use of the binary
-level: low