mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
Revert "Changed the rule to download only and not the copy"
This reverts commit 1324bc1ad1
.
This commit is contained in:
parent
1324bc1ad1
commit
1455d414bc
@ -1,6 +1,6 @@
|
||||
title: Ingress Tool Transfer Using Replace.exe
|
||||
id: 6ccf0c00-1061-4195-a724-6d9c0058b036
|
||||
description: Detect Download operations using Replace.exe.
|
||||
description: Detect Copy and Download operations using Replace.exe.
|
||||
status: experimental
|
||||
references:
|
||||
- https://lolbas-project.github.io/lolbas/Binaries/Replace
|
||||
@ -16,10 +16,10 @@ detection:
|
||||
selection:
|
||||
Image|endswith:
|
||||
- '\replace.exe'
|
||||
CommandLine|contains|all:
|
||||
CommandLine|contains:
|
||||
- "\\\\\\\\"
|
||||
- "/A"
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Legitimate use of the binary to download files from a share
|
||||
- Legitimate use of the binary
|
||||
level: low
|
||||
|
Loading…
Reference in New Issue
Block a user