From 00490c1f68b422acd3488fd7b700a5d1d754fb41 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Tue, 13 Jul 2021 12:34:58 -0600 Subject: [PATCH] bypass UAC via ICMLuaUtil: fix ATT&CK mapping --- host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml index aa0769943..11a023580 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml @@ -5,7 +5,7 @@ rule: author: anamaria.martinezgom@fireeye.com scope: function att&ck: - - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Access Control [T1548.002] + - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] references: - https://gist.github.com/hfiref0x/196af729106b780db1c73428b5a5d68d examples: