rule: removed Zebrocy rule because it doesn't work that way

reason: command line gets split up at the '&' character, which results in two command lines
This commit is contained in:
Florian Roth 2019-11-18 11:42:38 +01:00
parent 04288771a1
commit 2c54d1afe4

View File

@ -1,20 +0,0 @@
title: Sofacy Zebrocy
id: 8545cb01-102e-41ee-babd-46bd24e8cb97
author: Florian Roth
description: Detects Sofacy's Zebrocy malware execution
references:
- https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
tags:
- attack.execution
- attack.g0020
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine: '*cmd.exe /c SYSTEMINFO & TASKLIST'
condition: selection
falsepositives:
- Unknown
level: critical