security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update privilege_escalation_persistence_phantom_dll.toml (#1228)

Browse Source 
(cherry picked from commit 6626cbb943)
This commit is contained in:
Brent Murphy
2021-06-01 09:29:09 -04:00
committed by github-actions[bot]
parent f9805954ee
commit f91e0facea
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/privilege_escalation_persistence_phantom_dll.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/01/07"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/05/27"
[rule]
author = ["Elastic"]
@@ -49,7 +49,7 @@ library where dll.name :
"windowsperformancerecordercontrol.dll",
"diagtrack_win.dll"
) and
not (dll.code_signature.subject_name : "Microsoft Windows" and dll.code_signature.status : "trusted")
not (dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and dll.code_signature.status : "trusted")
'''