feat: update reference proc_creation_win_wmic_process_creation.yml (S…

…igmaHQ#4315)
umairqamar · Jun 16, 2023 · 6312dd1 · 6312dd1
1 parent e8407c3
commit 6312dd1
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml b/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml
@@ -7,6 +7,7 @@ status: test
 description: Detects new process creation using WMIC via the "process call create" flag
 references:
     - https://www.sans.org/blog/wmic-for-incident-response/
+    - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process
 author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
 date: 2019/01/16
 modified: 2023/02/14