From 56264d2db16e35fa8c5f98495ef487ea8e4afd26 Mon Sep 17 00:00:00 2001 From: "@" <@> Date: Thu, 17 Sep 2020 16:43:33 -0500 Subject: [PATCH] fix formatting --- PrivilegeEscalation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PrivilegeEscalation.md b/PrivilegeEscalation.md index 38a1db7..d2f92c3 100644 --- a/PrivilegeEscalation.md +++ b/PrivilegeEscalation.md @@ -32,7 +32,7 @@ Detects application shimming through sdbinst or registry modification. Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md) Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. -** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... *** +** Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\... ** ``` SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command"