mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 09:25:17 +00:00
16 lines
511 B
YAML
16 lines
511 B
YAML
|
alert:
|
||
|
|
- debug
|
||
|
|
description: Detects suspicious use of calc.exe with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion
|
||
|
|
filter:
|
||
|
|
- query:
|
||
|
|
query_string:
|
||
|
|
query: (data.win.eventdata.commandLine.keyword:*\\calc.exe\ * OR (data.win.eventdata.image.keyword:*\\calc.exe AND (NOT (data.win.eventdata.image.keyword:*\\Windows\\Sys*))))
|
||
|
|
index: wazuh-alerts-3.x-*
|
||
|
|
name: 737e618a-a410-49b5-bec3-9e55ff7fbc15_0
|
||
|
|
priority: 2
|
||
|
|
realert:
|
||
|
|
minutes: 0
|
||
|
|
type: any
|
||
|
|
|
||
|
|
|