mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
461 B
YAML
16 lines
461 B
YAML
|
alert:
|
||
|
|
- debug
|
||
|
|
description: Detects executables launched outside their default directories as used by Lazarus Group (Bluenoroff)
|
||
|
|
filter:
|
||
|
|
- query:
|
||
|
|
query_string:
|
||
|
|
query: (data.win.eventdata.image.keyword:(*\\msdtc.exe OR *\\gpvc.exe) AND (NOT (data.win.eventdata.image.keyword:(C\:\\Windows\\System32\\* OR C\:\\Windows\\SysWOW64\\*))))
|
||
|
|
index: wazuh-alerts-3.x-*
|
||
|
|
name: 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b_0
|
||
|
|
priority: 2
|
||
|
|
realert:
|
||
|
|
minutes: 0
|
||
|
|
type: any
|
||
|
|
|
||
|
|
|