Merge pull request #49 from SnaffCon/l0ss-patch-1

SnaffCon · Jul 29, 2021 · 16c0ee7 · 16c0ee7
2 parents 85af5cd + 42ac7b9
commit 16c0ee7
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/SnaffCore/Config/DefaultRules/FileContentRules.cs b/SnaffCore/Config/DefaultRules/FileContentRules.cs
@@ -358,6 +358,7 @@ private void BuildFileContentRules()
                     // PS
                     "net user ",
                     "psexec .{0,100} -p ",
+                    "net use .{0,300} /user:",
                     "-SecureString",
                     "-AsPlainText",
                     "\\[Net.NetworkCredential\\]::new\\(",
@@ -410,7 +411,7 @@ private void BuildFileContentRules()
                     // creation of scheduled tasks with password
                     "schtasks.{1,300}(/rp\\s|/p\\s)",
                     // looking for net use or net user commands since these can contain credentials
-                    "net user? ",
+                    "net user ",
                     "psexec .{0,100} -p ",
                     "net use .{0,300} /user:"
                 }