From e666dd19985a6c98b5c6d88cb9959d4db54213f0 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 5 Mar 2021 11:49:49 -0500 Subject: [PATCH] moved back to endpoint --- detections/deprecated/uncommon_processes_on_endpoint.yml | 1 - .../detect_mimikatz_using_loaded_images.yml | 0 2 files changed, 1 deletion(-) rename detections/{deprecated => endpoint}/detect_mimikatz_using_loaded_images.yml (100%) diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 5a6cd007e6..2613179677 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -26,7 +26,6 @@ tags: analytic_story: - Windows Privilege Escalation - Unusual Processes - - Cloud Federated Credential Abuse cis20: - CIS 2 kill_chain_phases: diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml similarity index 100% rename from detections/deprecated/detect_mimikatz_using_loaded_images.yml rename to detections/endpoint/detect_mimikatz_using_loaded_images.yml