mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
David Dorsey
3d25c40bf7
Broke out macros definition into it's own manifest Created macro manifests for all of current macros that we ship Created lookup file manifest Created lookup file manifests for all current lookup files that we ship
1.0 KiB
1.0 KiB
| 1 | process_name | uncommon_default | category_default | analytic_story_default | kill_chain_phase_default | mitre_attack_default |
|---|---|---|---|---|---|---|
| 2 | sethc.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 3 | utilman.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 4 | osk.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 5 | magnify.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 6 | narrator.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 7 | displayswitch.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 8 | atbroker.exe | true | needs_accessibility | Windows Privilege Escalation | Actions on Objectives | Execution|Accessibility Features |
| 9 | quser.exe | true | DHS Report TA18-074A|Unusual Processes | Actions on Objectives | Execution |