Update proc_creation_win_cmd_mklink_osk_cmd.yml

Recommend a change in the Tactic mapping
phantinuss · Aug 29, 2023 · 8efc81a · 8efc81a
1 parent 60b8e9b
commit 8efc81a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml b/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
@@ -9,7 +9,8 @@ author: frack113
 date: 2022/12/11
 modified: 2022/12/20
 tags:
-    - attack.credential_access
+    - attack.privilege_escalation
+    - attack.persistence
     - attack.t1546.008
 logsource:
     product: windows