admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ingress Tool Transfer Story Adds

Browse Source
This commit is contained in:
mhaag-spl
2021-03-31 11:32:45 -06:00
parent 6fc1292813
commit 2db2f77d69
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/any_powershell_downloadfile.yml
+1
View File
@@ -31,6 +31,7 @@ references:
tags:
analytic_story:
- Malicious PowerShell
- Ingress Tool Transfer
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
kill_chain_phases:
detections/endpoint/any_powershell_downloadstring.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
analytic_story:
- Malicious PowerShell
- HAFNIUM Group
- Ingress Tool Transfer
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log