admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___windows_certutil_decode_file.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-02-22 14:58:49 -07:00
parent fb9bdc0203
commit dfb089db4e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_certutil_decode_file.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded