Mirrors/keyboardcrunch-sentinelone-attack-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries synced 2026-06-08 09:15:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated T1485

Browse Source
This commit is contained in:
@
2020-09-27 11:52:51 -05:00
parent 9340e2a284
commit 40b378a6e3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Tactics/Impact.md
+1 -1
View File
@@ -15,7 +15,7 @@ Atomics: [T1485](https://github.com/redcanaryco/atomic-red-team/blob/master/atom
Detection of SDelete (by display name) and execution of DD command on *nix operating systems.
```
(AgentOS In ("linux","osx") AND TgtProcName = "dd") OR TgtProcDisplayName = "Secure file delete"
(AgentOS In ("linux","osx") AND TgtProcName = "dd" AND TgtProcCmdLine ContainsCIS "of=") OR TgtProcDisplayName = "Secure file delete"
```
### T1490 Inhibit System Recovery