mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
9 lines
1.0 KiB
CSV
9 lines
1.0 KiB
CSV
process_name,uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default
|
|
sethc.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
utilman.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
osk.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
magnify.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
narrator.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
displayswitch.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
atbroker.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
|
quser.exe,true,,DHS Report TA18-074A|Unusual Processes,Actions on Objectives,Execution |