valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix logsource for remote_powershell_session_process.yml

Browse Source
This commit is contained in:
yugoslavskiy 2019-11-10 23:10:24 +03:00
parent 5756df1922
commit 1f5a31f0e7
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
rules/windows/sysmon/sysmon_remote_powershell_session_process.yml → rules/windows/process_creation/win_remote_powershell_session_process.yml
View File

@ -7,16 +7,13 @@ author: Roberto Rodriguez @Cyb3rWard0g
references: references:
- https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/powershell_remote_session.md - https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1086_powershell/powershell_remote_session.md
logsource: logsource:
category: process_creation
product: windows product: windows
service: sysmon
detection: detection:
selection_1: selection:
EventID: 1 - Image|endswith: '\wsmprovhost.exe'
Image|endswith: '\wsmprovhost.exe' - ParentImage|endswith: '\wsmprovhost.exe'
selection_2: condition: selection
EventID: 1
ParentImage|endswith: '\wsmprovhost.exe'
condition: selection_1 or selection_2
falsepositives: falsepositives:
- Unknown - Unknown
level: critical level: critical