Restricted Software Access By SRP

Rule Info

Name
Restricted Software Access By SRP
Author
frack113
Description
Detects restricted access to applications by the Software Restriction Policies (SRP) policy
Reference
https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
Date
2023-01-12 00:00:00
Modified
None
Id
b4c8da4a-1c12-46b0-8a2b-0a8521d03442
Tags
attack.defense-evasion attack.t1072
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=b4c8da4a-1c12-46b0-8a2b-0a8521d03442

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
github-actions[bot]
Merge PR #4611 from @nasbench - Promote Older Rules Status From `experimental` To `test`
2023-12-01
ae960f088
Nasreddine Bencherchali
chore: rename folders
2023-04-14
6949ebf24
Nasreddine Bencherchali
fix: add new ref
2023-01-12
e82413145
frack113
Update win_software_restriction_policies_block.yml
2023-01-12
45d7d1cd3
frack113
Update win_software_restriction_policies_block.yml
2023-01-12
1470c3ebc
frack113
Add win_software_restriction_policies_block
2023-01-12
b0b8c8cba
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022