valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'patch-15' of https://github.com/vburov/sigma into patch-15

Browse Source
This commit is contained in:
Vasiliy Burov 2020-10-28 11:27:48 +03:00
commit 931ccde3e6
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/file_event/win_susp_multiple_files_renamed_or_deleted.yml
View File

@ -1,6 +1,6 @@
title: Suspicious Multiple File Rename Or Delete Occurred
id: 97919310-06a7-482c-9639-92b67ed63cf8
author: Vasiliy Burov; oscd.community
author: Vasiliy Burov, oscd.community
date: 2020/10/16
description: Detects multiple file rename or delete events occurrence within a specified period of time by a same user. These events may signalize about ransomware activity.
status: experimental
@ -22,6 +22,5 @@ detection:
timeframe: 30s
condition: selection | count() by SubjectLogonId > 10
falsepositives:
- software uninstallation
- files restore activities
- Unlikely
level: high