Rene K
@HunterBlueCompletionist
0 followers4 downloads26 copies0 likes305 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Platforms
1
MITRE Techniques
1
1
1
1
1
Detects scenarios where a security policy is exported to a .cfg file using secedit.exe and subsequently accessed/reviewed using notepad.exe on the same Windows host. This activity may indicate reconnaissance or staging for privilege escalation or lateral movement by a threat actor.
