update metadata

Author: swachchhanda000

rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml

@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019-08-11
-modified: 2025-09-22
+modified: 2025-10-22
 tags:
     - attack.execution
     - attack.t1059.001

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -8,7 +8,7 @@ references:
     - https://github.com/bohops/WSMan-WinRM
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020-06-24
-modified: 2025-09-22
+modified: 2025-10-22
 tags:
     - attack.execution
     - attack.t1059.001

rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml

@@ -9,7 +9,7 @@ references:
     - https://github.com/1337Rin/Swag-PSO
 author: frack113
 date: 2023-01-08
-modified: 2025-09-22
+modified: 2025-10-22
 tags:
     - attack.defense-evasion
     - attack.execution

rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml

@@ -11,7 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-02-28
-modified: 2025-09-22
+modified: 2025-10-22
 tags:
     - attack.persistence
     - attack.t1543.003

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

@@ -7,7 +7,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
 author: frack113
 date: 2022-04-04
-modified: 2025-10-14
+modified: 2025-10-22
 tags:
     - attack.defense-evasion
     - attack.t1564.001