security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3528 from qasimqlf/master

Browse Source 
Update proc_creation_win_uac_bypass_icmluautil.yml
This commit is contained in:
frack113
2022-09-27 19:32:27 +02:00
committed by GitHub
parent e2aacfea35 ec657a3118
commit f220b72b0a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
+1 -1
View File
@@ -16,7 +16,7 @@ logsource:
product: windows
detection:
selection:
PranetImage|endswith: '\dllhost.exe'
ParentImage|endswith: '\dllhost.exe'
ParentCommandLine|contains:
- '/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
- '/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'