admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update wsreset_uac_bypass.yml

Browse Source
This commit is contained in:
tccontre
2021-07-15 09:15:34 +02:00
committed by GitHub
parent 501783dc47
commit 4f42b02fbc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/wsreset_uac_bypass.yml
+2 -2
View File
@@ -52,9 +52,9 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Incoming
message: Suspicious modification of registry $Registry.registry_path$ with possible payload path $Registry.registry_value_name$ in $Registry.dest$
message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
observable:
- name: Registry.dest
- name: dest
type: Hostname
role:
- Victim