valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_system_exe_anomaly.yml

Browse Source
This commit is contained in:
Jonhnathan 2020-10-15 19:55:57 -03:00 committed by GitHub
parent 434c6257f0
commit 737fbd1619
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 31 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
rules/windows/process_creation/win_system_exe_anomaly.yml
View File

@ -14,39 +14,39 @@ logsource:
product: windows
detection:
selection:
Image:
- '*\svchost.exe'
- '*\rundll32.exe'
- '*\services.exe'
- '*\powershell.exe'
- '*\regsvr32.exe'
- '*\spoolsv.exe'
- '*\lsass.exe'
- '*\smss.exe'
- '*\csrss.exe'
- '*\conhost.exe'
- '*\wininit.exe'
- '*\lsm.exe'
- '*\winlogon.exe'
- '*\explorer.exe'
- '*\taskhost.exe'
- '*\Taskmgr.exe'
- '*\sihost.exe'
- '*\RuntimeBroker.exe'
- '*\smartscreen.exe'
- '*\dllhost.exe'
- '*\audiodg.exe'
- '*\wlanext.exe'
Image|endswith:
- '\svchost.exe'
- '\rundll32.exe'
- '\services.exe'
- '\powershell.exe'
- '\regsvr32.exe'
- '\spoolsv.exe'
- '\lsass.exe'
- '\smss.exe'
- '\csrss.exe'
- '\conhost.exe'
- '\wininit.exe'
- '\lsm.exe'
- '\winlogon.exe'
- '\explorer.exe'
- '\taskhost.exe'
- '\Taskmgr.exe'
- '\sihost.exe'
- '\RuntimeBroker.exe'
- '\smartscreen.exe'
- '\dllhost.exe'
- '\audiodg.exe'
- '\wlanext.exe'
filter:
Image:
- 'C:\Windows\System32\\*'
- 'C:\Windows\system32\\*'
- 'C:\Windows\SysWow64\\*'
- 'C:\Windows\SysWOW64\\*'
Image|startswith:
- 'C:\Windows\System32\\'
- 'C:\Windows\system32\\'
- 'C:\Windows\SysWow64\\'
- 'C:\Windows\SysWOW64\\'
- 'C:\Windows\explorer.exe'
- 'C:\Windows\winsxs\\*'
- 'C:\Windows\WinSxS\\*'
- '\SystemRoot\System32\\*'
- 'C:\Windows\winsxs\\'
- 'C:\Windows\WinSxS\\'
- '\SystemRoot\System32\\'
condition: selection and not filter
fields:
- ComputerName