From a47084d2e6e4c4fc1cd3e57915e976c75414fe96 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Feb 2022 15:49:21 -0600 Subject: [PATCH] Missing reference --- .../endpoint/ssa___windows_diskshadow_proxy_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index a57382c3b5..c5c8181640 100644 --- a/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -11,7 +11,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives references: -- +- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ tags: analytic_story: - Living Off The Land