mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
714 B
YAML
16 lines
714 B
YAML
|
alert:
|
||
|
|
- debug
|
||
|
|
description: Detects process access LSASS memory which is typical for credentials dumping tools
|
||
|
|
filter:
|
||
|
|
- query:
|
||
|
|
query_string:
|
||
|
|
query: ((data.win.eventdata.targetImage.keyword:*\\lsass.exe AND data.win.eventdata.grantedAccess.keyword:(*0x40* OR *0x1000* OR *0x1400* OR *0x100000* OR *0x1410* OR *0x1010* OR *0x1438* OR *0x143a* OR *0x1418* OR *0x1f0fff* OR *0x1f1fff* OR *0x1f2fff* OR *0x1f3fff*)) AND (NOT (process_path.keyword:(*\\wmiprvse.exe OR *\\taskmgr.exe OR *\\procexp64.exe OR *\\procexp.exe OR *\\lsm.exe OR *\\csrss.exe OR *\\wininit.exe OR *\\vmtoolsd.exe))))
|
||
|
|
index: wazuh-alerts-3.x-*
|
||
|
|
name: 32d0d3e2-e58d-4d41-926b-18b520b2b32d_0
|
||
|
|
priority: 2
|
||
|
|
realert:
|
||
|
|
minutes: 0
|
||
|
|
type: any
|
||
|
|
|
||
|
|
|