From 7321acd0a1eae7c6a11e1ff2b43f1a797016e7c9 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:06:59 -0400 Subject: [PATCH] Update process-injection.md New link for silent process exit --- defense-evasion/process-injection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index d7f8c03..a4b304d 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -100,7 +100,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan |[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction| |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--| |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--| -|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--| +|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--| |[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| |[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--| |[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|