valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1272 from bczyz1/patch-2

Browse Source 
Fix typo in win_apt_lazarus_session_hijack.yml
This commit is contained in:
Florian Roth 2020-11-10 13:35:08 +01:00 committed by GitHub
commit 2e9d7951a6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/windows/process_creation/win_apt_lazarus_session_highjack.yml
View File

@ -8,7 +8,7 @@ tags:
- attack.defense_evasion
- attack.t1036 # an old one
- attack.t1036.005
author: Trent Liffick (@tliffick)
author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)
date: 2020/06/03
logsource:
category: process_creation
@ -16,7 +16,7 @@ logsource:
detection:
selection:
Image:
- '*\mstdc.exe'
- '*\msdtc.exe'
- '*\gpvc.exe'
filter:
Image: