From 3b546ebdf2d48a0577743e52d0d5680dfbac665f Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 9 Nov 2021 09:01:28 -0500 Subject: [PATCH] Update ssa___ptt_pth_kerb_ntlm_origin_device.yml --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index ca47f62d57..3430eca603 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -1,7 +1,7 @@ name: Potential Pass the Token or Hash Observed by an Event Collecting Device id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 -version: 1 -date: '2021-09-01' +version: 2 +date: '2021-11-05' author: Stanislav Miskovic, Splunk type: TTP datamodel: []