admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding references

Browse Source
This commit is contained in:
Michael Hart
2021-06-25 14:56:08 -04:00
parent 518d03b1a1
commit 98a7b4e3ff
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+2
View File
@@ -30,6 +30,8 @@ known_false_positives: Legitimate programs and administrators will execute sc.ex
possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than
seven times in a short period of time.
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://attack.mitre.org/techniques/T1562/001/
tags:
analytic_story:
- Windows Defense Evasion Tactics