admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_indirect_command_execution_via_pcalua.yml

Browse Source 
Adding second reference for pcalua.exe
This commit is contained in:
pyth0n1c
2022-04-05 10:15:26 -07:00
committed by GitHub
parent 0cde033ac1
commit b385ef2ead
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+1 -1
View File
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
known_false_positives: Some legacy applications may be run using pcalua.exe. Filter these results as needed.
references:
- https://twitter.com/KyleHanslovan/status/912659279806640128
- REF2 - FIND ANOTHER REFERENCE
- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
tags:
analytic_story:
- Living Off The Land