Skip to content

Commit a6d52d3

Browse files
committed
Update lateral_movement_remote_file_copy_hidden_share.toml
1 parent 5ce195a commit a6d52d3

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/windows/lateral_movement_remote_file_copy_hidden_share.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ type = "eql"
8383

8484
query = '''
8585
process where host.os.type == "windows" and event.type == "start" and user.id != "S-1-5-18" and
86-
process.name : ("cmd.exe", "powershell.exe") and
86+
process.name : ("cmd.exe", "powershell.exe") and
8787
process.command_line : "*\\\\*\\*$*" and process.command_line : ("* copy*", "* move*", "* cp *", "* mv *")
8888
'''
8989

0 commit comments

Comments
 (0)