From ea56db2bed0501319c61361b2e92c20f76fbfa7f Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 27 Jul 2021 11:09:35 +0200 Subject: [PATCH] forget date field --- rules/windows/process_creation/process_creation_susp_winzip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/process_creation_susp_winzip.yml b/rules/windows/process_creation/process_creation_susp_winzip.yml index da7d2a78b..2e668c63e 100644 --- a/rules/windows/process_creation/process_creation_susp_winzip.yml +++ b/rules/windows/process_creation/process_creation_susp_winzip.yml @@ -2,7 +2,7 @@ title: Compress Data and Lock With Password for Exfiltration With WINZIP id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d status: experimental author: frack113 -date: +date: 2021/07/27 description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md