valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Rule: CertUtil UA

Browse Source 
https://twitter.com/ItsReallyNick/status/1047151134501216258
This commit is contained in:
Florian Roth 2018-10-06 16:47:20 +02:00
parent 4eeb07a736
commit 54678fcb36
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/proxy/proxy_ua_suspicious.yml
View File

@ -20,6 +20,7 @@ detection:
- ' Mozilla/*' # leading space
- 'Mozila/*' # single 'l'
- '_'
- 'CertUtil URL Agent' # https://twitter.com/stvemillertime/status/985150675527974912
falsepositives:
UserAgent:
- 'Mozilla/3.0 * Acrobat *' # Acrobat with linked content