admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

asyncrat-onenote-chain2

Browse Source
This commit is contained in:
tccontre
2023-01-26 18:00:00 +01:00
parent b6f2b63081
commit 6e695cb16e
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+2
View File
@@ -22,9 +22,11 @@ references:
- https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
- https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
- https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
tags:
analytic_story:
- Brute Ratel C4
- AsyncRAT
asset_type: Endpoint
cis20:
- CIS 3