mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
38 lines
1.0 KiB
YAML
38 lines
1.0 KiB
YAML
title: Image Load of VSS_PS.dll by Uncommon Executable
|
|
id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
|
|
status: experimental
|
|
description: Detects the image load of vss_ps.dll by uncommon executables using OriginalFileName datapoint
|
|
author: Markus Neis, @markus_neis
|
|
date: 2021/07/07
|
|
references:
|
|
- 1bd85e1caa1415ebdc8852c91e37bbb7
|
|
- https://twitter.com/am0nsec/status/1412232114980982787
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.impact
|
|
- attack.t1490
|
|
logsource:
|
|
category: image_load
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
ImageLoaded|endswith:
|
|
- '\vss_ps.dll'
|
|
filter:
|
|
Image|endswith:
|
|
- '\svchost.exe'
|
|
- '\msiexec.exe'
|
|
- '\vssvc.exe'
|
|
- '\srtasks.exe'
|
|
- '\tiworker.exe'
|
|
- '\dllhost.exe'
|
|
- '\searchindexer.exe'
|
|
- 'dismhost.exe'
|
|
- 'taskhostw.exe'
|
|
- '\clussvc.exe'
|
|
Image|contains: 'c:\windows\'
|
|
condition: selection and not filter
|
|
falsepositives:
|
|
- unknown
|
|
level: high
|