change status to experimental

frack113 · Jan 30, 2024 · 9139629 · 9139629
1 parent d29d20b
commit 9139629
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/..._creation_win_wscript_cscript_dropper.yml → ..._creation_win_wscript_cscript_dropper.yml b/..._creation_win_wscript_cscript_dropper.yml → ..._creation_win_wscript_cscript_dropper.yml
@@ -3,14 +3,14 @@ id: cea72823-df4d-4567-950c-0b579eaf0846
 related:
     - id: 1e33157c-53b1-41ad-bbcc-780b80b58288
       type: similar
-status: deprecated
+status: experimental
 description: Detects wscript/cscript executions of scripts located in user directories
 references:
     - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
     - https://redcanary.com/blog/gootloader/
 author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
 date: 2019/01/16
-modified: 2024/01/18
+modified: 2024/01/30
 tags:
     - attack.execution
     - attack.t1059.005