From 0746ad946ed5db5c3848ab33054d9e6d8650cccb Mon Sep 17 00:00:00 2001 From: "@" <@> Date: Thu, 17 Sep 2020 16:44:50 -0500 Subject: [PATCH] fix formatting --- PrivilegeEscalation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PrivilegeEscalation.md b/PrivilegeEscalation.md index d2f92c3..fcb5a8a 100644 --- a/PrivilegeEscalation.md +++ b/PrivilegeEscalation.md @@ -32,7 +32,7 @@ Detects application shimming through sdbinst or registry modification. Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md) Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. -** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... ** +*Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\...* ``` SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command"