Merge pull request #3612 from qasimqlf/patch-8
Update and rename posh_ps_copy_item_system32.yml
This commit is contained in:
+3
-3
@@ -1,4 +1,4 @@
|
||||
title: Powershell Install a DLL in System32
|
||||
title: Powershell Install a DLL in System Directory
|
||||
id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
|
||||
status: experimental
|
||||
description: Uses PowerShell to install/copy a a file into a system directory such as "System32" or "SysWOW64"
|
||||
@@ -6,7 +6,7 @@ references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
|
||||
author: frack113, Nasreddine Bencherchali
|
||||
date: 2021/12/27
|
||||
modified: 2022/07/07
|
||||
modified: 2022/10/20
|
||||
logsource:
|
||||
product: windows
|
||||
category: ps_script
|
||||
@@ -26,4 +26,4 @@ falsepositives:
|
||||
level: high
|
||||
tags:
|
||||
- attack.credential_access
|
||||
- attack.t1556.002
|
||||
- attack.t1556.002
|
||||
Reference in New Issue
Block a user