admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_sensitive_registry_hive_dump_via_commandline.yml

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2025-01-20 18:33:03 +01:00
parent 473b732972
commit 65cea95443
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml
+2 -2
View File
@@ -77,12 +77,12 @@ tags:
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
- name: True Positive Test - Sysmon
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
- name: True Positive Test - CrowdStrike
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike