mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
503 B
YAML
16 lines
503 B
YAML
alert:
|
|
- debug
|
|
description: Detects suspect access to svchost process memory such as that used by Invoke-Phantom to kill the winRM windows event logging service.
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.eventdata.targetImage.keyword:*\\windows\\system32\\svchost.exe AND data.win.eventdata.grantedAccess:"0x1f3fff" AND data.win.eventdata.callTrace.keyword:(*unknown*))
|
|
index: wazuh-alerts-3.x-*
|
|
name: 166e9c50-8cd9-44af-815d-d1f0c0e90dde_0
|
|
priority: 2
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|