-
Hi, thanks for your effort in developing this enumeration script. It's a really nice project and it is really useful for engagements to quickly find privesc vulns, however, sadly this is only fully us…
-
Add an option to log information about elevated processes. Logging should be available either while a user is administrator, or always.
-
**Describe the bug**
The default query for the SIEM rule "Net command via SYSTEM account" appears to be incorrect.
**To Reproduce**
Default query:
```
process where event.type in ("start", "pro…
-
## Description
Rules that support sysmon and uses the `user.id` field are prone to FPs and FNs because sysmon don't really have `user.id` data, as per this screenshot as an example:
1.11.2921.0
### Other Software
wsl.exe (10.0.22000.1)
### Steps to reproduce
Loading Windows Terminal will launch `wsl.exe` despite Windows …
-
This issue aims to test manually Emotet malware to define the requirements to develop an automated E2E test.
To achieve this we will follow these guides:
- https://github.com/wazuh/wazuh-automatio…
-
| Target version | Related issue | Related PR |
|--------------------|--------------------|-----------------|
| 4.4 | https://github.com/wazuh/wazuh/issues/13099 | https://github.com/wazuh/wazuh/pul…