 Samirbous
|
181bbcb8c9
|
[New Rule] Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindow (#486)
* [New Rule] Remote Execution via DCOM - ShellBrowserWindow or ShellWindows
* adjusted rule description and name
* Update rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
* filtering localhost
* Update lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
* eql syntax
* ecs_version
* Update rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* relinted and del ecs_vers
* re-linted
* deleted ecs_version
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
|
2020-12-04 17:37:31 +01:00 |
|