megan201296 eb8a0636c5 Update win_mal_ursnif.yml ...

After @thomaspatzke changed to HKU, I did some reading. HKU is for HKEY_User, not HKEY_Current_User (what this threat is tied to. However, he was correct that HKCU does not exist as a prefix for sysmon (see the notes section under event id 13 here: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml). Changed to ignore the key name, confirmed that the key is still uniique.

2019-04-14 11:51:13 -05:00

..

av_exploiting.yml

adding MPreter as McAfee classifies it

2019-02-22 15:22:10 +11:00

av_password_dumper.yml

ATT&CK tagging QA

2018-09-20 12:44:44 +02:00

av_relevant_files.yml

Escaped '\*' to '\\*' where required

2019-02-03 00:24:57 +01:00

av_webshell.yml

ATT&CK tagging QA

2018-09-20 12:44:44 +02:00

win_mal_ursnif.yml

Update win_mal_ursnif.yml

2019-04-14 11:51:13 -05:00