admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

MMC

Browse Source 
T1218.014
This commit is contained in:
mhaag-spl
2022-07-01 07:43:45 -06:00
parent aeceacc737
commit 76642e3c97
3 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+2 -1
View File
@@ -51,10 +51,11 @@ tags:
impact: 90
kill_chain_phases:
- Exploitation
message: Mmc.exe spawned a LOLBAS process on $dest
message: Mmc.exe spawned a LOLBAS process on $dest$.
mitre_attack_id:
- T1021
- T1021.003
- T1218.014
observable:
- name: dest
type: Endpoint
detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+1
View File
@@ -59,6 +59,7 @@ tags:
- T1053.005
- T1543.003
- T1059.001
- T1218.014
observable:
- name: dest
type: Endpoint
detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+1
View File
@@ -42,6 +42,7 @@ tags:
mitre_attack_id:
- T1548.002
- T1548
- T1218.014
observable:
- name: Computer
type: Hostname