fixed

2022-09-23 15:21:33 +08:00
parent 011496349a
commit d5b88c7a01
8 changed files with 54 additions and 13 deletions
--- a/Server/rules/py/attck/action.py
+++ b/Server/rules/py/attck/action.py
@@ -6,13 +6,6 @@ rule = [
        'attck_hit':['T1562.001'],
        'name': 'Impair Defenses: Disable or Modify Tools'
    },
-    {
-        'rules': [
-            'action == "processaccess" and targetimage =~ ".*lsass.exe"',
-        ],
-        'attck_hit':['T1003'],
-        'name': 'OS Credential Dumping: LSASS Memory'
-    },
    {
        'rules': [
            'action == "processaccess" and calltrace =~ ".*unknown.*" and not calltrace =~ ".*conpty\.node.*" and not calltrace =~ ".*java\.dll.*" and not calltrace =~ ".*appvisvsubsystems64\.dll.*" and not calltrace =~ ".*twinui\.dll.*" and not calltrace =~ ".*nativeimages.*" and not targetimage == "c:\\windows\\system32\\cmd.exe"',