valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Conforming to Rule Creation Guide.

Browse Source
This commit is contained in:
Bhabesh Rai 2020-07-14 14:20:07 +05:45
parent 66ad325fde
commit 6fb045aa4b
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/windows/other/win_defender_psexec_wmi_asr.yml
View File

@ -1,5 +1,5 @@
title: Process Creations from PSExec and WMI Detected via Attack Surface Reduction
id: ffa2790e-21f4-90da-dd33-ed8b77a9bf78
title: PSExec and WMI Process Creations Block
id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003
description: Detects blocking of process creations originating from PSExec and WMI commands
status: experimental
references:
@ -8,9 +8,7 @@ references:
author: Bhabesh Raj
date: 2020/07/14
tags:
- attack.lateral_movement
- attack.execution
- attack.t1570
- attack.t1047
- attack.t1569
- attack.t1569.002