valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: FPs with Suspect Svchost Activity

Browse Source
This commit is contained in:
Florian Roth 2021-02-24 13:55:40 +01:00
parent 0489d4bfa4
commit f8b6b9d68e
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/windows/process_creation/win_susp_svchost_no_cli.yml
View File

@ -6,7 +6,7 @@ references:
- https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
author: David Burkett
date: 2019/12/28
modified: 2020/08/28
modified: 2021/02/24
tags:
- attack.defense_evasion
- attack.privilege_escalation
@ -20,9 +20,10 @@ detection:
selection2:
Image|endswith: '\svchost.exe'
filter:
ParentImage|endswith:
- ParentImage|endswith:
- '\rpcnet.exe'
- '\rpcnetp.exe'
- CommandLine: null # no CommandLine value available
condition: (selection1 and selection2) and not filter
fields:
- CommandLine