Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel

2022-04-09 19:19:12 +02:00
parent 8030af2ea8 c18f246c23
commit 1a5fc46d8d
1 changed files with 4 additions and 1 deletions
@@ -4,6 +4,7 @@ status: experimental
 description: Detects programs that use base64 encoded values provided via command line, which is often an indicator of obfuscation but could also be used for legitimate purposes (e.g. if certain special characters would mess with the command line interface, enccrypted keys etc.)
 author: Florian Roth
 date: 2022/04/05
+modified: 2022/04/08
 references:
   - https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/d
 logsource:
@@ -13,7 +14,9 @@ detection:
   selection:
      - CommandLine|endswith: '=='
      - CommandLine|contains: '== -'
-   condition: selection
+   filter:
+      Image|endswith: '\VeeamAgent.exe'
+   condition: selection and not 1 of filter*
 falsepositives:
   - Legitimate software that uses base64 encoded values in its command line
 level: medium