mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
Update sysmon_quarkspw_filedump.yml
This commit is contained in:
parent
dde5b46726
commit
182b12614b
@ -18,7 +18,9 @@ logsource:
|
||||
detection:
|
||||
selection:
|
||||
# Sysmon: File Creation (ID 11)
|
||||
TargetFilename|contains: '\AppData\Local\Temp\SAM-*.dmp'
|
||||
TargetFilename|contains|all:
|
||||
- '\AppData\Local\Temp\SAM-'
|
||||
- '.dmp'
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Unknown
|
||||
|
Loading…
Reference in New Issue
Block a user