diff --git a/PrivilegeEscalation.md b/PrivilegeEscalation.md index d2f92c3..fcb5a8a 100644 --- a/PrivilegeEscalation.md +++ b/PrivilegeEscalation.md @@ -32,7 +32,7 @@ Detects application shimming through sdbinst or registry modification. Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md) Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. -** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... ** +*Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\...* ``` SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command"