Added ATTCK Mapping

2018-08-05 14:00:22 +02:00
parent b65cb5eaca
commit fc091fe3d7
1 changed files with 3 additions and 0 deletions
@@ -3,6 +3,9 @@ status: experimental
 description: Detects execution of sdbinst writing to default shim database path C:\Windows\AppPatch\*
 references:
    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
+tags:
+    - attack.persistence
+    - attack.T1138
 author: Markus Neis
 date: 2018/03/08
 logsource: