security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3888 from SigmaHQ/aurora-false-positive-fixing

Browse Source 
fix: FPs noticed with Aurora
This commit is contained in:
Nasreddine Bencherchali
2023-01-09 10:39:54 +01:00
committed by GitHub
parent a9d23bc7fb 7f45405867
commit 17aaf7fdcd
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml
+4 -2
View File
@@ -6,7 +6,7 @@ references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
author: 'Avneet Singh @v3t0_, oscd.community'
date: 2020/10/18
modified: 2022/11/12
modified: 2023/01/06
tags:
- attack.defense_evasion
- attack.t1055.001
@@ -28,7 +28,9 @@ detection:
# GrandparentImage: C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin\MSBuild.exe
# ParentCommandLine: "C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe" /nologo /nodemode:1 /nodeReuse:true /low:false
# CommandLine: "C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\Tracker.exe" @"C:\Users\user\AppData\Local\Temp\tmp05c7789bc5534838bf96d7a0fed1ffff.tmp" /c "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.29.30133\bin\HostX86\x64\Lib.exe"
ParentImage|endswith: '\Msbuild\Current\Bin\MSBuild.exe'
ParentImage|endswith:
- '\Msbuild\Current\Bin\MSBuild.exe'
- '\Msbuild\Current\Bin\amd64\MSBuild.exe'
CommandLine|contains|all:
- '\VC\Tools\MSVC\'
- '\bin\HostX86\x64\'