mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 09:25:17 +00:00
rule: removed Zebrocy rule because it doesn't work that way
reason: command line gets split up at the '&' character, which results in two command lines
This commit is contained in:
parent
04288771a1
commit
2c54d1afe4
@ -1,20 +0,0 @@
|
||||
title: Sofacy Zebrocy
|
||||
id: 8545cb01-102e-41ee-babd-46bd24e8cb97
|
||||
author: Florian Roth
|
||||
description: Detects Sofacy's Zebrocy malware execution
|
||||
references:
|
||||
- https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
|
||||
tags:
|
||||
- attack.execution
|
||||
- attack.g0020
|
||||
- attack.t1059
|
||||
logsource:
|
||||
category: process_creation
|
||||
product: windows
|
||||
detection:
|
||||
selection:
|
||||
CommandLine: '*cmd.exe /c SYSTEMINFO & TASKLIST'
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Unknown
|
||||
level: critical
|
Loading…
Reference in New Issue
Block a user