valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_office_spawn_exe_from_users_directory.yml

Browse Source
This commit is contained in:
Jonhnathan 2020-11-27 16:04:55 -03:00 committed by GitHub
parent f6aaa957ff
commit bf5aa947e3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/process_creation/win_office_spawn_exe_from_users_directory.yml
View File

@ -26,8 +26,9 @@ detection:
- '\MSPUB.exe'
- '\VISIO.exe'
- '\OUTLOOK.EXE'
Image:
- 'C:\users\\*.exe'
Image|contains|all:
- 'C:\users\'
- '.exe'
condition: selection
fields:
- CommandLine