valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 10:13:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update powershell_suspicious_profile_create.yml

Browse Source
This commit is contained in:
hieuttmmo 2019-10-25 10:53:21 +07:00 committed by GitHub
parent edb698c7f7
commit e86ab608f2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
rules/windows/powershell/powershell_suspicious_profile_create.yml
View File

@ -1,22 +1,24 @@
title: Powershell profile modify title: 'Powershell profile modify'
status: experimental status: experimental
description: 'Detects a change in profile.ps1 of Powershell profile' description: 'Detects a change in profile.ps1 of Powershell profile'
references: references:
- 'https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/' - 'https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/'
tags:
- attack.persistence
author: HieuTT35 author: HieuTT35
date: 2019/10/24 date: 2019/10/24
logsource: logsource:
product: windows product: windows
service: sysmon service: sysmon
detection: detection:
selection: event:
EventID: 11 EventID: 11
TargetFilename|re: target1:
- '.*\\My Documents\\PowerShell\\(Microsoft\.)?.*(Profile|profile)\.ps1' TargetFilename|re: '.*\\My Documents\\PowerShell\\(Microsoft\.)?.*(Profile|profile)\.ps1'
- 'C\:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\(Microsoft\.)?.*(Profile|profile)\.ps1' target2:
condition: selection TargetFilename|re: 'C\:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\(Microsoft\.)?.*(Profile|profile)\.ps1'
condition: event and (target1 or target2)
falsepositives: falsepositives:
- unknown - 'System administrator create Powershell profile manually'
level: high level: high
tags:
- attack.persistence
- attack.privilege_escalation