admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___windows_certutil_urlcache_download.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-02-16 14:30:10 -07:00
parent eecd75c4a9
commit 252ed2576f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will