Added perfc.dat keyword to NotPetya rule

2024-11-07 01:45:21 +00:00 · 2017-06-28 10:35:42 +02:00 · 2017-06-28 10:35:42 +02:00 · ece1d7e3a8
commit ece1d7e3a8
parent a3e0e37163
1 changed files with 3 additions and 1 deletions
--- a/rules/windows/malware/sysmon_malware_notpetya.yml
+++ b/rules/windows/malware/sysmon_malware_notpetya.yml
@ -20,7 +20,9 @@ detection:
        EventID: 1
        Image: '*\wevtutil.exe'
        CommandLine: '* cl *'
-    condition: fsutil_clean_journal or pipe_com or event_clean
+    perfc_keyword:
+        - '*\perfc.dat*'
+    condition: fsutil_clean_journal or pipe_com or event_clean or perfc_keyword
 falsepositives:
    - Admin activity
 level: critical