Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

T1174 Password Filter DLL #31

Open
saqibakkramkhan opened this issue Apr 16, 2020 · 0 comments
Open

T1174 Password Filter DLL #31

saqibakkramkhan opened this issue Apr 16, 2020 · 0 comments
Labels
bug Something isn't working

Comments

@saqibakkramkhan
Copy link

saqibakkramkhan commented Apr 16, 2020 •
edited
Loading

The EQL query for "T1174 Password Filter DLL" shows
registry where hive.hklm and
registry_path == "SYSTEM\ControlSet\Control\Lsa\Notification Packages*"
| unique registry_path, process_path

the registry path should be "SYSTEM\*ControlSet*\Control\Lsa\Notification Packages" as the above condition does not allow to search for LSA "notification packages" from "currentcontrolset"
(thats * around ControlSet)
https://eqllib.readthedocs.io/en/latest/analytics/ae6ae50f-69f3-4e85-bfe2-2db9d1422517.html
@saqibakkramkhan saqibakkramkhan added the bug Something isn't working label Apr 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@saqibakkramkhan