diff --git a/PrivilegeEscalation.md b/PrivilegeEscalation.md index 38a1db7..d2f92c3 100644 --- a/PrivilegeEscalation.md +++ b/PrivilegeEscalation.md @@ -32,7 +32,7 @@ Detects application shimming through sdbinst or registry modification. Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md) Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. -** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... *** +** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... ** ``` SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command"