valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #71 from Karneades/patch-1

Browse Source 
Add missing binaries
This commit is contained in:
Florian Roth 2018-03-16 11:49:37 +01:00 committed by GitHub
commit ff45901ea3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
View File

@ -16,12 +16,18 @@ detection:
- '*\cmd.exe sethc.exe *'
- '*\cmd.exe utilman.exe *'
- '*\cmd.exe osk.exe *'
- '*\cmd.exe Magnify.exe *'
- '*\cmd.exe Narrator.exe *'
- '*\cmd.exe DisplaySwitch.exe *'
selection_registry:
EventID: 13
TargetObject:
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger'
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger'
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger'
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe\Debugger'
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe\Debugger'
- '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisplaySwitch.exe\Debugger'
EventType: 'SetValue'
condition: 1 of them
falsepositives: