Restricted Software Access By SRP

Rule Info

Name
Restricted Software Access By SRP
Description
Detects restricted access to applications by the Software Restriction Policies (SRP) policy
Reference
https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
Modified
None
Date
2023-01-12 00:00:00
Author
frack113
Tags
attack.defense_evasion DEMO attack.t1072
Id
b4c8da4a-1c12-46b0-8a2b-0a8521d03442
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=b4c8da4a-1c12-46b0-8a2b-0a8521d03442

Rule History

Author
Commit
Title
Date
Nasreddine Bencherchali
e82413145
fix: add new ref
2023-01-12
frack113
45d7d1cd3
Update win_software_restriction_policies_block.yml
2023-01-12
frack113
1470c3ebc
Update win_software_restriction_policies_block.yml
2023-01-12
frack113
b0b8c8cba
Add win_software_restriction_policies_block
2023-01-12
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022