valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor: slightly improved Greenbug rule

Browse Source
This commit is contained in:
Florian Roth 2020-05-21 13:38:11 +02:00
parent 9a3b6c1c77
commit 91c4c4ecc5
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/process_creation/win_apt_greenbug_may20.yml
View File

@ -6,6 +6,7 @@ references:
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
author: Florian Roth
date: 2020/05/20
modified: 2020/05/21
tags:
- attack.g0049
logsource:
@ -17,9 +18,7 @@ detection:
- 'bitsadmin /transfer'
- 'CSIDL_APPDATA'
selection2:
CommandLine|contains|all:
- 'PowerShell.exe'
- '-ExecutionPolicy Bypass'
CommandLine|contains:
- 'CSIDL_SYSTEM_DRIVE'
selection3:
CommandLine|contains: