valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #296 from Karneades/patch-1

Browse Source 
Remove backslashes in CommandLine for sticky key rule
This commit is contained in:
Florian Roth 2019-04-03 19:44:02 +02:00 committed by GitHub
commit 13f86e9333
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
View File

@ -39,9 +39,9 @@ detection:
ParentImage: ParentImage:
- '*\winlogon.exe' - '*\winlogon.exe'
CommandLine: CommandLine:
- '*\cmd.exe sethc.exe *' - '*cmd.exe sethc.exe *'
- '*\cmd.exe utilman.exe *' - '*cmd.exe utilman.exe *'
- '*\cmd.exe osk.exe *' - '*cmd.exe osk.exe *'
- '*\cmd.exe Magnify.exe *' - '*cmd.exe Magnify.exe *'
- '*\cmd.exe Narrator.exe *' - '*cmd.exe Narrator.exe *'
- '*\cmd.exe DisplaySwitch.exe *' - '*cmd.exe DisplaySwitch.exe *'