valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sigmac WDATP backend: renamed action types

Browse Source
This commit is contained in:
Thomas Patzke 2018-07-10 22:49:38 +02:00
parent 57727d2397
commit d064d24fbe
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/sigma/backends.py
View File

@ -1027,14 +1027,14 @@ class WindowsDefenderATPBackend(SingleTextQueryBackend):
return None
elif self.service == "sysmon" and value == 8: # Create Remote Thread
self.table = "MiscEvents"
return "ActionType == \"CreateRemoteThread\""
return "ActionType == \"CreateRemoteThreadApiCall\""
elif self.service == "sysmon" and value == 11: # File Creation
self.table = "FileCreationEvents"
return None
elif self.service == "sysmon" and value == 13 \
or self.service == "security" and value == 4657: # Set Registry Value
self.table = "RegistryEvents"
return "ActionType == \"SetValue\""
return "ActionType == \"RegistryValueSet\""
elif self.service == "security" and value == 4624:
self.table = "LogonEvents"
return None