valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update and rename win_custom_service_execution.yml to win_service_execution.yml

Browse Source
This commit is contained in:
yugoslavskiy 2019-11-05 02:57:15 +03:00 committed by GitHub
parent 3d5f5e2fe7
commit 27e63abcc4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_custom_service_execution.yml → rules/windows/process_creation/win_service_execution.yml
View File

@ -1,4 +1,4 @@
title: Custom Service Execution
title: Service Execution
status: experimental
description: Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with New Service and Modify Existing Service during service persistence or privilege escalation.
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community