Merge pull request #3612 from qasimqlf/patch-8

Update and rename posh_ps_copy_item_system32.yml
This commit is contained in:
frack113
2022-10-21 06:48:10 +02:00
committed by GitHub
@@ -1,4 +1,4 @@
title: Powershell Install a DLL in System32
title: Powershell Install a DLL in System Directory
id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
status: experimental
description: Uses PowerShell to install/copy a a file into a system directory such as "System32" or "SysWOW64"
@@ -6,7 +6,7 @@ references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
author: frack113, Nasreddine Bencherchali
date: 2021/12/27
modified: 2022/07/07
modified: 2022/10/20
logsource:
product: windows
category: ps_script
@@ -26,4 +26,4 @@ falsepositives:
level: high
tags:
- attack.credential_access
- attack.t1556.002
- attack.t1556.002