mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 10:13:57 +00:00
f75ad98903
EID 4674 with the proposed attributes is very rare in prod environment. https://jpcertcc.github.io/ToolAnalysisResultSheet/details/wmiexec-vbs.htm |
||
|---|---|---|
| .. | ||
| builtin | ||
| create_remote_thread | ||
| create_stream_hash | ||
| deprecated | ||
| dns_query | ||
| driver_load | ||
| file_delete | ||
| file_event | ||
| image_load | ||
| malware | ||
| network_connection | ||
| other | ||
| pipe_created | ||
| powershell | ||
| process_access | ||
| process_creation | ||
| raw_access_thread | ||
| registry_event | ||
| sysmon | ||
| wmi_event | ||