6 Commits

Author	SHA1	Message	Date
secman-pl	9768f275d0	Update sysmon_susp_regsvr32_anomalies ... Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe. example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100 SCT script code: var objShell = new ActiveXObject("WScript.shell");	2017-08-29 12:21:47 +02:00
Florian Roth	f3f2c14b3a	Added reference to regsvr32 rule	2017-08-29 08:45:29 +02:00
Florian Roth	371b41acd9	Improved regsvr32.exe whitelisting bypass rule ... thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560	2017-06-07 13:46:36 +02:00
Florian Roth	e5ad1b2f84	Improved regsvr32 whitelisting bypass rule	2017-06-07 12:02:55 +02:00
Florian Roth	1fd7a92e87	Regsvr32.exe anomalies (bugfix and new selection)	2017-06-07 11:43:25 +02:00
Florian Roth	a5c3f424c1	regsvr32 Anomalies	2017-04-16 12:02:29 +02:00