mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
501 B
YAML
16 lines
501 B
YAML
alert:
|
|
- debug
|
|
description: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.eventdata.description:"\?" AND (data.win.eventdata.fileVersion:"\?" OR file_product:"\?" OR data.win.eventdata.company:"\?") AND data.win.eventdata.image.keyword:*\\Downloads\\*)
|
|
index: wazuh-alerts-3.x-*
|
|
name: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43_0
|
|
priority: 3
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|