admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'TR2850_RBA_PrivEsc' of github.com:splunk/security_content into TR2850_RBA_PrivEsc

Browse Source
This commit is contained in:
mvelazco
2023-05-23 17:26:30 -04:00
parent 508ca2a051 ac6b96493b
commit 71fcc66c96
6 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_modify_registry_auto_update_notif.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 50
impact: 50
message: A registry modification in Windows auto update notification on $dest$
detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification to disable Windows Defender notification on $dest$
detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 50
impact: 50
message: a registry modification in Windows auto update configuration in $dest$
detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 30
impact: 30
message: A registry modification in Windows auto update configuration on $dest$
detections/endpoint/windows_modify_registry_no_auto_update.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification in Windows auto update configuration on $dest$
detections/endpoint/windows_modify_registry_tamper_protection.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification to tamper Windows Defender protection on $dest$