mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
11 lines
278 B
YAML
11 lines
278 B
YAML
name: prohibited_apps_launching_cmd
|
|
date: 2024-12-23
|
|
version: 2
|
|
id: e6ac9b38-051b-4e40-afd1-16837ddfe7fc
|
|
author: Splunk Threat Research Team
|
|
lookup_type: csv
|
|
description: A list of processes that should not be launching cmd.exe
|
|
match_type:
|
|
- WILDCARD(prohibited_applications)
|
|
|