Mirrors/keyboardcrunch-sentinelone-attack-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries synced 2026-06-08 17:17:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

formatting update

Browse Source
This commit is contained in:
@
2020-10-23 15:50:16 -05:00
parent 9f3198ba03
commit c7deea4971
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Tactics/CredentialAccess.md
+2
View File
@@ -56,7 +56,9 @@ Detection focuses on sysvol GP Policy xml file enumeration, with findstr or Get-
` `
TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR
TgtProcCmdline ContainsCIS "Get-GPPPassword" OR TgtProcCmdline ContainsCIS "Get-GPPPassword" OR
SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'" SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
` `