admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
mandiant-capa-rules/host-interaction/user
T
History
Elad Levi 5d990adef2 Move impersonate user from nursery (#1072) 
* Move and update impersonate-user rule

Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.

* Simplify API checks in impersonate-user rule

Removed optional and or conditions for GetUserName and DuplicateToken APIs

* Bring the Ex back
2025-09-03 10:27:04 -06:00
..
impersonate-user.yml
Move impersonate user from nursery (#1072)
2025-09-03 10:27:04 -06:00