valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 18:23:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

commented tags

Browse Source
This commit is contained in:
Ivan Dyachkov 2020-10-14 16:56:52 +03:00
parent a8d5ddd93d
commit 24eb0b92be
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_susp_diskshadow.yml
View File

@ -4,7 +4,7 @@ status: experimental
description: Detects using Diskshadow.exe to execute arbitrary code in text file
references:
- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
tags:
#tags:
# - attack.execution
# - attack.t1218
author: Ivan Dyachkov, oscd.community