valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_malware_emotet.yml

Browse Source
This commit is contained in:
Jonhnathan 2020-10-15 18:01:00 -03:00 committed by GitHub
parent 035cd43e58
commit d962e5b844
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
rules/windows/process_creation/win_malware_emotet.yml
View File

@ -21,15 +21,15 @@ logsource:
product: windows
detection:
selection:
CommandLine:
- '* -e* PAA*'
- '*JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*' # $env:userprofile
- '*QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA*' # $env:userprofile
- '*kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*' # $env:userprofile
- '*IgAoACcAKgAnACkAOwAkA*' # "('*');$
- '*IAKAAnACoAJwApADsAJA*' # "('*');$
- '*iACgAJwAqACcAKQA7ACQA*' # "('*');$
- '*JABGAGwAeAByAGgAYwBmAGQ*'
CommandLine|contains:
- ' -e* PAA'
- 'JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ' # $env:userprofile
- 'QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA' # $env:userprofile
- 'kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA' # $env:userprofile
- 'IgAoACcAKgAnACkAOwAkA' # "('*');$
- 'IAKAAnACoAJwApADsAJA' # "('*');$
- 'iACgAJwAqACcAKQA7ACQA' # "('*');$
- 'JABGAGwAeAByAGgAYwBmAGQ'
condition: selection
fields:
- CommandLine