mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
531 B
YAML
16 lines
531 B
YAML
alert:
|
|
- debug
|
|
description: Detects Registry modifcations performaed by Ke3chang malware in campaigns running in 2019 and 2020
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: data.win.eventdata.commandLine.keyword:(*\-Property\ DWORD\ \-name\ DisableFirstRunCustomize\ \-value\ 2\ \-Force* OR *\-Property\ String\ \-name\ Check_Associations\ \-value* OR *\-Property\ DWORD\ \-name\ IEHarden\ \-value\ 0\ \-Force*)
|
|
index: wazuh-alerts-3.x-*
|
|
name: 7b544661-69fc-419f-9a59-82ccc328f205_0
|
|
priority: 1
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|