security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update credential_access_mod_wdigest_security_provider.toml (#1751)

Browse Source 
(cherry picked from commit 40095d95bf)
This commit is contained in:
Jonhnathan
2022-02-04 15:38:12 -03:00
committed by github-actions[bot]
parent d7011f7128
commit a884d8a237
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/credential_access_mod_wdigest_security_provider.toml
+5 -4
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/19"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2022/02/03"
[rule]
author = ["Elastic"]
@@ -28,9 +28,10 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
registry where event.type in ("creation", "change") and
registry.path:"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential" and
registry.data.strings:"1"
registry where event.type : ("creation", "change") and
registry.path :
"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
and registry.data.strings : ("1", "0x00000001")
'''