fixed

2022-09-23 15:21:33 +08:00
parent 011496349a
commit d5b88c7a01
8 changed files with 54 additions and 13 deletions
--- a/Server/rules/py/ioa/action.py
+++ b/Server/rules/py/ioa/action.py
@@ -1,4 +1,12 @@
 rule = [
+    {
+        'rules': [
+            'action == "processaccess" and targetimage =~ ".*lsass.exe"',
+        ],
+        'attck_hit':['T1003'],
+        'score': 100,
+        'name': 'OS Credential Dumping: LSASS Memory'
+    },
    {
        'rules': [
            'action == "processaccess" and targetimage =~ ".*lsass.exe" and grantedaccess & 0x0010 and sourceimage =~ ".*rundll32.exe"',