3 Commits

Author	SHA1	Message	Date
megan201296	eb8a0636c5	Update win_mal_ursnif.yml ... After @thomaspatzke changed to HKU, I did some reading. HKU is for HKEY_User, not HKEY_Current_User (what this threat is tied to. However, he was correct that HKCU does not exist as a prefix for sysmon (see the notes section under event id 13 here: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml). Changed to ignore the key name, confirmed that the key is still uniique.	2019-04-14 11:51:13 -05:00
Thomas Patzke	02239fa288	Changed registry root key ... According to [this](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete) it is abbreviated to HKU.	2019-02-22 21:30:30 +01:00
megan201296	34f9d17b26	Create win_mal_ursnif.yml	2019-02-13 15:22:57 -06:00