From 730359aa0db0f1bff8504f9356c700f1b44ce78f Mon Sep 17 00:00:00 2001 From: Conor Richard Date: Sat, 17 Sep 2022 21:21:13 -0400 Subject: [PATCH] Changed AWL MitreID and removed extra YAML record start "---" --- yml/OSBinaries/Ssh.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/yml/OSBinaries/Ssh.yml b/yml/OSBinaries/Ssh.yml index f419ce5..38f030c 100644 --- a/yml/OSBinaries/Ssh.yml +++ b/yml/OSBinaries/Ssh.yml @@ -16,7 +16,7 @@ Commands: Usecase: Performs execution of specified file, can be used to bypass Application Whitelisting. Category: AWL Bypass Privileges: User - MitreID: T1202 + MitreID: T1218 OperatingSystem: Windows 10 1809, Windows Server 2019 Full_Path: - Path: c:\windows\system32\OpenSSH\ssh.exe @@ -25,4 +25,3 @@ Detection: - IOC: command line arguments specifying execution. Acknowledgement: - Person: Akshat Pradhan ---- \ No newline at end of file