mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 17:35:19 +00:00
rule: removed Zebrocy rule because it doesn't work that way
reason: command line gets split up at the '&' character, which results in two command lines
This commit is contained in:
parent
04288771a1
commit
2c54d1afe4
@ -1,20 +0,0 @@
|
|||||||
title: Sofacy Zebrocy
|
|
||||||
id: 8545cb01-102e-41ee-babd-46bd24e8cb97
|
|
||||||
author: Florian Roth
|
|
||||||
description: Detects Sofacy's Zebrocy malware execution
|
|
||||||
references:
|
|
||||||
- https://app.any.run/tasks/54acca9a-394e-4384-a0c8-91a96d36c81d
|
|
||||||
tags:
|
|
||||||
- attack.execution
|
|
||||||
- attack.g0020
|
|
||||||
- attack.t1059
|
|
||||||
logsource:
|
|
||||||
category: process_creation
|
|
||||||
product: windows
|
|
||||||
detection:
|
|
||||||
selection:
|
|
||||||
CommandLine: '*cmd.exe /c SYSTEMINFO & TASKLIST'
|
|
||||||
condition: selection
|
|
||||||
falsepositives:
|
|
||||||
- Unknown
|
|
||||||
level: critical
|
|
Loading…
Reference in New Issue
Block a user