admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update exchange_powershell_module_usage.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-08-25 12:57:35 -06:00
parent 25aaf33a98
commit 77aea09e0d
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/endpoint/exchange_powershell_module_usage.yml
+1 -2
View File
@@ -4,8 +4,7 @@ version: 1
date: '2021-08-25'
author: Michael Haag
type: TTP
datamodel:
- Endpoint
datamodel: []
description: 'The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits. \
Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \