valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_susp_powershell_enc_cmd.yml

Browse Source
This commit is contained in:
Jonhnathan 2020-10-15 19:38:47 -03:00 committed by GitHub
parent 4485436957
commit 610ae5ddd7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
View File

@ -16,27 +16,27 @@ logsource:
product: windows
detection:
selection:
CommandLine:
- '* -e JAB*'
- '* -e JAB*'
- '* -e JAB*'
- '* -e JAB*'
- '* -e JAB*'
- '* -e JAB*'
- '* -en JAB*'
- '* -enc JAB*'
- '* -enc* JAB*'
- '* -w hidden -e* JAB*'
- '* BA^J e-'
- '* -e SUVYI*'
- '* -e aWV4I*'
- '* -e SQBFAFgA*'
- '* -e aQBlAHgA*'
- '* -enc SUVYI*'
- '* -enc aWV4I*'
- '* -enc SQBFAFgA*'
- '* -enc aQBlAHgA*'
CommandLine|contains:
- ' -e'
- ' -en'
- ' -enc'
- ' -w hidden -e'
selection2:
- 'JAB'
selection3:
- '-e'
- '-enc'
selection4:
- ' BA^J'
- 'SUVYI'
- ' aWV4I'
- ' SQBFAFgA'
- ' aQBlAHgA'
- ' SUVYI'
- ' aWV4I'
- ' SQBFAFgA'
- ' aQBlAHgA'
falsepositive1:
CommandLine: '* -ExecutionPolicy remotesigned *'
condition: selection and not falsepositive1
CommandLine|contains: ' -ExecutionPolicy remotesigned '
condition: (selection and selection2) or (selection3 and selection4) and not falsepositive1
level: high