From 5bdfd1f170b937b1083524ff490d9525854bfc8e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 11:08:30 -0700 Subject: [PATCH] Update get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml --- ...defaultdomainpasswordpolicy_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 3ccd474b43..85ecebbf31 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: Powershell process having commandline $ScriptBlockText$ to query domain password policy on $dest$ + message: Powershell process having commandline "Get-ADDefaultDomainPasswordPolicy" to query domain password policy on $dest$ mitre_attack_id: - T1201 observable: