From b46acc0d4f83aa891040fcf77ec2fd192bdbf078 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Wed, 4 Nov 2020 09:28:38 -0800 Subject: [PATCH] Fix SPL in the Mimikatz module detection --- .../ssa___applying_stolen_credentials_via_mimikatz_modules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index e7fb014fc2..d377d2527e 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR - match_regex(cmd_line, /(?i)token::elevate/)=true OR + match_regex(cmd_line, /(?i)token::elevate/)=true ) | eval start_time = timestamp,