admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-07-19 11:18:25 -07:00
committed by GitHub
parent 8492ab898a 33031010d5
commit 2ea536eff8
3 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+2 -1
View File
@@ -51,10 +51,11 @@ tags:
impact: 90
kill_chain_phases:
- Exploitation
message: Mmc.exe spawned a LOLBAS process on $dest
message: Mmc.exe spawned a LOLBAS process on $dest$.
mitre_attack_id:
- T1021
- T1021.003
- T1218.014
observable:
- name: dest
type: Endpoint
detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+1
View File
@@ -59,6 +59,7 @@ tags:
- T1053.005
- T1543.003
- T1059.001
- T1218.014
observable:
- name: dest
type: Endpoint
detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+1
View File
@@ -42,6 +42,7 @@ tags:
mitre_attack_id:
- T1548.002
- T1548
- T1218.014
observable:
- name: Computer
type: Hostname