valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update att&ck tag

Browse Source
This commit is contained in:
Lurkkeli 2018-08-07 08:27:24 +02:00 committed by GitHub
parent 3456f9a74d
commit b50c13dd1f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/windows/sysmon/sysmon_susp_vssadmin_ntds_activity.yml
View File

@ -26,6 +26,9 @@ detection:
fields:
- CommandLine
- ParentCommandLine
tags:
- attack.credential_access
- attack.t1003
falsepositives:
- Administrative activity
level: high