mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
removed unwanted file
This commit is contained in:
parent
2af501c9f5
commit
3c89f46899
@ -1,29 +0,0 @@
|
||||
title: zLoader Registry Changes
|
||||
id: 916ae9c5-a21a-4e34-b2ea-deccd16fba01
|
||||
description: Detects the registry changes made by zLoader malware
|
||||
status: experimental
|
||||
references:
|
||||
- https://clickallthethings.wordpress.com/2020/05/13/zloader-and-xlm-4-0-making-evasion-great-again/
|
||||
author: Trent Liffick
|
||||
date: 2020/05/13
|
||||
tags:
|
||||
- attack.execution
|
||||
- attack.t1112
|
||||
logsource:
|
||||
product: windows
|
||||
service: sysmon
|
||||
detection:
|
||||
selection:
|
||||
EventID:
|
||||
- 12
|
||||
- 13
|
||||
TargetObject:
|
||||
- '*SOFTWARE\Microsoft\Office\\*\Word\Security'
|
||||
condition: selection
|
||||
fields:
|
||||
- Image
|
||||
- TargetObject
|
||||
- TargetDetails
|
||||
falsepositives:
|
||||
- unknown
|
||||
level: low
|
Loading…
Reference in New Issue
Block a user