Merge branch 'master' of https://github.com/Neo23x0/sigma

rules/windows/process_creation/win_malware_emotet.yml

@@ -3,6 +3,7 @@ status: experimental
 description: Detects all Emotet like process executions that are not covered by the more generic rules
 author: Florian Roth
 date: 2019/09/30
+modified: 2019/10/16
 references:
     - https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
     - https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
@@ -12,9 +13,17 @@ logsource:
 detection:
     selection:
         CommandLine:
+            - '* -e PAA*'
+            - '* -en PAA*'
             - '* -enc PAA*'
             - '* -enco PAA*'
             - '* -encod PAA*'
+            - '*JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*'  # $env:userprofile
+            - '*QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA*'  # $env:userprofile
+            - '*kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*'  # $env:userprofile
+            - '*IgAoACcAKgAnACkAOwAkA*'  # "('*');$
+            - '*IAKAAnACoAJwApADsAJA*'  # "('*');$
+            - '*iACgAJwAqACcAKQA7ACQA*'  # "('*');$
     condition: selection
 fields:
     - CommandLine