valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

remove false positives in Windows being too broad and add specific keys looked at + add keys from wow64

Browse Source
This commit is contained in:
ecco 2020-08-18 05:28:37 -04:00
parent 3d9855dd06
commit de4810233c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
rules/windows/registry_event/sysmon_asep_reg_keys_modification.yml
View File

@ -8,7 +8,7 @@ tags:
- attack.persistence
- attack.t1060
date: 2019/10/21
modified: 2019/11/10
modified: 2020/08/18
author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community
logsource:
category: registry_event
@ -23,7 +23,12 @@ detection:
- '\software\Microsoft\Windows\CurrentVersion\RunServicesOnce'
- '\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit'
- '\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'
- '\software\Microsoft\Windows NT\CurrentVersion\Windows'
- '\software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs' # Appinit DLL
- '\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs' # Appinit DLL
- '\software\Microsoft\Windows NT\CurrentVersion\Windows\Load' # WindowsShellLoadAndRun in HKCU
- '\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Load' # WindowsShellLoadAndRun in HKCU
- '\software\Microsoft\Windows NT\CurrentVersion\Windows\Run' # WindowsShellLoadAndRun in HKCU
- '\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Run' # WindowsShellLoadAndRun in HKCU
- '\software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'
condition: selection
falsepositives: