From 28af2af96c018302db94b777827ed69690d4e871 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Jul 2021 15:46:49 -0600 Subject: [PATCH] Update detect_copy_of_shadowcopy_with_script_block_logging.yml --- .../detect_copy_of_shadowcopy_with_script_block_logging.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index 4f146516a3..2ed8cac06d 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -9,7 +9,8 @@ datamodel: description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output - to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ + to Windows event logs. Dependent upon volume, enable no critical endpoints or all. + \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \