Improved regsvr32 whitelisting bypass rule

2024-11-07 01:45:21 +00:00 · 2017-06-07 12:02:55 +02:00 · 2017-06-07 12:02:55 +02:00 · e5ad1b2f84
commit e5ad1b2f84
parent 1fd7a92e87
1 changed files with 2 additions and 1 deletions
--- a/rules/windows/sysmon/sysmon_susp_regsvr32_anomalies.yml
+++ b/rules/windows/sysmon/sysmon_susp_regsvr32_anomalies.yml
@ -20,9 +20,10 @@ detection:
    selection3:
        EventID: 1
        Image: '*\regsvr32.exe'
-        Commandline: '/i:http'
+        Commandline: '*/i:http* scrobj.dll'
    condition: selection1 or selection2 or selection3
 falsepositives:
    - Unknown
 level: high

+