Improved shell spawning rule

2024-11-07 09:48:58 +00:00 · 2018-04-11 20:09:28 +02:00 · 2018-04-11 20:09:28 +02:00 · 52d405bb1b
commit 52d405bb1b
parent ef7fb4cff1
1 changed files with 1 additions and 0 deletions
--- a/rules/windows/sysmon/sysmon_shell_spawn_susp_program.yml
+++ b/rules/windows/sysmon/sysmon_shell_spawn_susp_program.yml
@ -24,6 +24,7 @@ detection:
            - '*\nslookup.exe'
            - '*\certutil.exe'
            - '*\bitsadmin.exe'
+            - '*\mshta.exe'
    condition: selection
 fields:
    - CommandLine