valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update sysmon_new_dll_added_to_appcertdlls_registry_key.yml

Browse Source
This commit is contained in:
yugoslavskiy 2019-11-13 23:43:45 +03:00 committed by GitHub
parent e6e308ef51
commit bba360212a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
rules/windows/sysmon/sysmon_new_dll_added_to_appcertdlls_registry_key.yml
View File

@ -9,7 +9,21 @@ tags:
- attack.t1182
author: Ilyas Ochkov, oscd.community
date: 2019/10/25
modified: 2019/11/13
detection:
logsource:
product: windows
service: sysmon
detection:
selection:
- EventID:
- 12 # key create
- 13 # value set
TargetObject|contains: '\SYSTEM\'
TargetObject|endswith: '\Control\Session Manager\AppCertDlls'
- EventID: 14 # key rename
NewName|contains: '\SYSTEM\'
NewName|endswith: '\Control\Session Manager\AppCertDlls'
condition: 1 of them
fields:
- EventID
@ -19,30 +33,3 @@ fields:
falsepositives:
- Unkown
level: medium
---
logsource:
product: windows
service: sysmon
detection:
key_create:
EventID: 12
TargetObject:
- '*\SYSTEM\*\Control\Session Manager\AppCertDlls'
---
logsource:
product: windows
service: sysmon
detection:
value_set:
EventID: 13
TargetObject:
- '*\SYSTEM\*\Control\Session Manager\AppCertDlls'
---
logsource:
product: windows
service: sysmon
detection:
key_rename:
EventID: 14
NewName:
- '*\SYSTEM\*\Control\Session Manager\AppCertDlls'