admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

detections/endpoint/disabling_systemrestore_in_registry.yml

Browse Source
This commit is contained in:
tccontre
2022-03-17 13:54:37 +01:00
parent d7fccdb353
commit 07b501035e
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/disabling_systemrestore_in_registry.yml
+1 -2
View File
@@ -51,8 +51,7 @@ tags:
message: The Windows registry was modified to disable system restore on $dest$ by
$user$.
mitre_attack_id:
- T1562.001
- T1562
- T1490
observable:
- name: user
type: User