mirror of
https://github.com/keyboardcrunch/sentinelone-queries
synced 2026-06-11 02:11:21 +00:00
Cleaned up signature descriptions and metadata.
This commit is contained in:
@@ -2,7 +2,7 @@ title: Windows Share Creation
|
||||
description: Detecting the creation and use of Windows shares, may catch a lot of legitimate activity.
|
||||
author: keyboardcrunch
|
||||
date: 10/10/2020
|
||||
modified: null
|
||||
modified:
|
||||
mitre:
|
||||
tactic: Lateral Movement
|
||||
technique: T1021
|
||||
@@ -10,6 +10,7 @@ mitre:
|
||||
operating_system: windows
|
||||
query: TgtProcCmdLine ContainsCIS "New-PSDrive" OR (TgtProcName = "net.exe" AND TgtProcCmdLine
|
||||
ContainsCIS "use ")
|
||||
false_positives: Share creations.
|
||||
tags: null
|
||||
false_positives:
|
||||
- Share creation
|
||||
tags:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user