From 108974275d5532099a7d03e8af9a0a7a30bec46c Mon Sep 17 00:00:00 2001 From: Moritz Date: Fri, 14 Jul 2023 11:30:11 +0200 Subject: [PATCH] Update act-as-credential-manager-dll.yml closes #754 --- .../authentication-process/act-as-credential-manager-dll.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/persistence/authentication-process/act-as-credential-manager-dll.yml b/persistence/authentication-process/act-as-credential-manager-dll.yml index 55a77152..476b650c 100644 --- a/persistence/authentication-process/act-as-credential-manager-dll.yml +++ b/persistence/authentication-process/act-as-credential-manager-dll.yml @@ -6,7 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scope: file att&ck: - - Persistence::Modify Authentication Process [T1556] + - Persistence::Modify Authentication Process::Network Provider DLL [T1556.008] examples: - b283415c9df06f0e53b7d452d3e5c840c5bd7a6ce734a30bae4a869a57974a0e features: