valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_mal_flowcloud.yml

Browse Source
This commit is contained in:
Florian Roth 2021-07-22 11:09:45 +02:00 committed by GitHub
parent 3b5f3d8bef
commit 1cfb0e4689
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
rules/windows/malware/win_mal_flowcloud.yml
View File

@ -9,23 +9,19 @@ tags:
- attack.persistence
- attack.t1112
date: 2020/06/09
modified: 2021/07/15
modified: 2021/07/22
logsource:
product: windows
category: registry_event
detection:
selection:
EventID:
- 12 # key create
- 13 # value set
selection2:
- TargetObject:
- 'HKLM\HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}'
- 'HKLM\HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}'
- 'HKLM\HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}'
- TargetObject|startswith:
- 'HKLM\SYSTEM\Setup\PrintResponsor\'
condition: selection or selection2
condition: selection
falsepositives:
- Unknown
level: critical