valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_control_panel_item.yml

Browse Source
This commit is contained in:
Jonhnathan 2020-11-27 12:15:12 -03:00 committed by GitHub
parent bde2b95cdc
commit 3f9edf19a9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/process_creation/win_control_panel_item.yml
View File

@ -27,8 +27,9 @@ detection:
- '\System32\'
- '%System%'
selection2:
CommandLine|contains:
- 'reg add'
CommandLine|contains|all:
- 'reg'
- 'add'
selection3:
CommandLine|contains:
- 'CurrentVersion\\Control Panel\\CPLs'