valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

rule: FPs with WmiPrvSE rule

Browse Source
This commit is contained in:
Florian Roth 2020-11-05 16:44:33 +01:00
parent 908023fa66
commit c3785d6dc7
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/windows/process_creation/win_wmiprvse_spawning_process.yml
View File

@ -3,7 +3,7 @@ id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
description: Detects wmiprvse spawning processes description: Detects wmiprvse spawning processes
status: experimental status: experimental
date: 2019/08/15 date: 2019/08/15
modified: 2019/11/10 modified: 2020/11/05
author: Roberto Rodriguez @Cyb3rWard0g author: Roberto Rodriguez @Cyb3rWard0g
references: references:
- https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1047_windows_management_instrumentation/wmi_win32_process_create_remote.md - https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/tree/master/playbooks/windows/02_execution/T1047_windows_management_instrumentation/wmi_win32_process_create_remote.md
@ -19,7 +19,10 @@ detection:
filter: filter:
- LogonId: '0x3e7' # LUID 999 for SYSTEM - LogonId: '0x3e7' # LUID 999 for SYSTEM
- User: 'NT AUTHORITY\SYSTEM' # if we don't have LogonId data, fallback on username detection - User: 'NT AUTHORITY\SYSTEM' # if we don't have LogonId data, fallback on username detection
- Image|endswith:
- '\WmiPrvSE.exe'
- '\WerFault.exe'
condition: selection and not filter condition: selection and not filter
falsepositives: falsepositives:
- Unknown - Unknown
level: critical level: high