Skip to content

Commit

Permalink
added xcacls
Browse files Browse the repository at this point in the history
  • Loading branch information
@olafhartong
olafhartong committed Jun 21, 2023
1 parent 2e449b7 commit d174fe8
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion 1_process_creation/include_living_off_the_land.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@
<Rule name="File Permissions Modification" groupRelation="or">
<OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="is">takeown.exe</OriginalFileName>
<Image name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="image">forfiles.exe</Image>
<OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe</OriginalFileName>
<OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe;xcacls.exe</OriginalFileName>
</Rule>

<Rule name="Access Token Manipulation" groupRelation="or">
Expand Down

0 comments on commit d174fe8

Please sign in to comment.