Merge pull request SigmaHQ#4403 from tropChaud/patch-5

Update proc_creation_win_cmd_mklink_osk_cmd.yml
phantinuss · Aug 30, 2023 · 082c371 · 082c371
2 parents 60b8e9b + 8efc81a
commit 082c371
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml b/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
@@ -9,7 +9,8 @@ author: frack113
 date: 2022/12/11
 modified: 2022/12/20
 tags:
-    - attack.credential_access
+    - attack.privilege_escalation
+    - attack.persistence
     - attack.t1546.008
 logsource:
     product: windows