valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: bugfix in BEAR activity rule

Browse Source
This commit is contained in:
Florian Roth 2019-02-24 14:04:24 +01:00
parent 8b7f0508a7
commit a60b53a7df
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/apt/apt_bear_activity_gtr19.yml
View File

@ -28,7 +28,7 @@ detection:
selection2:
EventID: 1
Image: '*\adexplorer.exe'
CommandLine: '* -snapshot "" c:\users\*'
CommandLine: '* -snapshot "" c:\users\\*'
---
logsource:
product: windows
@ -41,4 +41,4 @@ detection:
selection2:
EventID: 4688
NewProcessName: '*\adexplorer.exe'
ProcessCommandLine: '* -snapshot "" c:\users\*'
ProcessCommandLine: '* -snapshot "" c:\users\\*'