admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-05-23 14:13:25 -07:00
committed by GitHub
parent cd3d7f4fad c65dda5c0a
commit eae0d37b69
6 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_modify_registry_auto_update_notif.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 50
impact: 50
message: A registry modification in Windows auto update notification on $dest$
detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification to disable Windows Defender notification on $dest$
detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 50
impact: 50
message: a registry modification in Windows auto update configuration in $dest$
detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 30
impact: 30
message: A registry modification in Windows auto update configuration on $dest$
detections/endpoint/windows_modify_registry_no_auto_update.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification in Windows auto update configuration on $dest$
detections/endpoint/windows_modify_registry_tamper_protection.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
analytic_story:
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
confidence: 70
impact: 70
message: A registry modification to tamper Windows Defender protection on $dest$