From 654771c8b824d6b95ddb0268193057abe03c4ef0 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 9 Nov 2021 09:00:44 -0500 Subject: [PATCH 1/2] Update ssa___ptt_pth_kerb_ntlm_dest_device.yml --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index d834998fe7..d4ce4252da 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -1,7 +1,7 @@ name: Potential Pass the Token or Hash Observed at the Destination Device id: 82e76b80-5cdb-4899-9b43-85dbe777b36d -version: 1 -date: '2021-09-01' +version: 2 +date: '2021-11-05' author: Stanislav Miskovic, Splunk type: TTP datamodel: [] From 3b546ebdf2d48a0577743e52d0d5680dfbac665f Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 9 Nov 2021 09:01:28 -0500 Subject: [PATCH 2/2] Update ssa___ptt_pth_kerb_ntlm_origin_device.yml --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index ca47f62d57..3430eca603 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -1,7 +1,7 @@ name: Potential Pass the Token or Hash Observed by an Event Collecting Device id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 -version: 1 -date: '2021-09-01' +version: 2 +date: '2021-11-05' author: Stanislav Miskovic, Splunk type: TTP datamodel: []