security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml

Browse Source 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
This commit is contained in:
Nasreddine Bencherchali
2023-08-04 11:30:44 +02:00
committed by GitHub
parent db8e3d2661
commit 134c3ff3aa
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
+1 -1
View File
@@ -36,7 +36,7 @@ detection:
- '-Encoded '
- 'FromBase64String'
selection_parent_susp_location:
- ParentCommandLine|re: '([Pp]rogram[Dd]ata|%[Aa]pp[Dd]ata%|%[Ll]ocal[Aa]pp[Dd]ata%|\[Aa]pp[Dd]ata\([Ll]ocal|[Rr]oaming|[Ll]ocal[Ll]ow)\[^\]{1,26}\.'
- ParentCommandLine|re: '([Pp]rogram[Dd]ata|%([Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\([Ll]ocal(Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
- ParentCommandLine|contains:
- ':\Users\Public\'
- ':\PerfLogs\'