From 98a7b4e3ff2b87e2fdaf23df71a92c599290ec13 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 25 Jun 2021 14:56:08 -0400 Subject: [PATCH] Adding references --- .../excessive_number_of_service_control_start_as_disabled.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index adf705fe61..05d0cc7fcc 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -30,6 +30,8 @@ known_false_positives: Legitimate programs and administrators will execute sc.ex possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. references: + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create + - https://attack.mitre.org/techniques/T1562/001/ tags: analytic_story: - Windows Defense Evasion Tactics