valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update silenttrinity_stager_msbuild_activity.yml

Browse Source
This commit is contained in:
S.kiran kumar 2020-10-14 13:04:49 +05:30 committed by GitHub
parent 6b25378a61
commit 2fa7ae2c1c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/sysmon/silenttrinity_stager_msbuild_activity.yml
View File

@ -17,7 +17,7 @@ logsource:
detection:
selection:
EventID: 3
ParentImage|endswith: '\msbuild.exe'
ParentImage|endswith: 'msbuild.exe'
condition: selection
fields:
- ParentImage