paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-10-27 01:43:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update MITRE_TECHNIQUES_FROM_SYSMON_EVENT13.xml

Browse Source
This commit is contained in:
SOCFortress
2022-08-17 21:41:08 -05:00
committed by GitHub
parent b48a42788d
commit 56efceb779
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
Windows_Sysmon/MITRE_TECHNIQUES_FROM_SYSMON_EVENT13.xml
View File

@@ -438,5 +438,16 @@
</mitre> </mitre>
<options>no_full_log</options> <options>no_full_log</options>
<group>sysmon_event_13,</group> <group>sysmon_event_13,</group>
</rule>
<!-- Sysmon - Event 13: PsExec Detection -->
<rule id="112141" level="13">
<if_sid>61615</if_sid>
<field name="win.eventdata.TargetObject">\\\\PsExec\\\\EulaAccepted$</field>
<description>Sysmon - Event 13: RegistryEvent PsExec EulaAccepted Detected</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule> </rule>
</group> </group>