T1499

[frack113]

https://attack.mitre.org/techniques/T1499/

sigma:
builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml: - attack.t1499.004
builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml: - attack.t1499.001