valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix invalid field name

Browse Source
This commit is contained in:
frack113 2021-07-06 14:16:01 +02:00
parent 12fb71b83b
commit fca3c72087
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/windows/builtin/win_rdp_reverse_tunnel.yml
View File

@ -7,7 +7,7 @@ references:
- https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
author: Samir Bousseaden
date: 2019/02/16
modified: 2020/08/23
modified: 2021/07/06
tags:
- attack.defense_evasion
- attack.command_and_control
@ -26,11 +26,11 @@ detection:
EventID: 5156
sourceRDP:
SourcePort: 3389
DestinationAddress:
DestAddress:
- '127.*'
- '::1'
destinationRDP:
DestinationPort: 3389
DestPort: 3389
SourceAddress:
- '127.*'
- '::1'