From 8b2f23ffbb9c4b976484dbc0e3cad114b34994e5 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Fri, 8 Apr 2022 16:32:46 +0200 Subject: [PATCH 1/2] fix: possible FP with Veeam software --- .../proc_creation_win_susp_base64_cmdline_param.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml index 69e6cf857..c68adbda7 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml @@ -13,7 +13,9 @@ detection: selection: - CommandLine|endswith: '==' - CommandLine|contains: '== -' - condition: selection + filter: + Image|endswith: '\VeeamAgent.exe' + condition: selection and not 1 of filter* falsepositives: - Legitimate software that uses base64 encoded values in its command line level: medium From c18f246c233ff606d410bd8abc0ba59ee72b744e Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Fri, 8 Apr 2022 16:33:19 +0200 Subject: [PATCH 2/2] docs: modified date --- .../proc_creation_win_susp_base64_cmdline_param.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml index c68adbda7..f6e9e1c00 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml @@ -4,6 +4,7 @@ status: experimental description: Detects programs that use base64 encoded values provided via command line, which is often an indicator of obfuscation but could also be used for legitimate purposes (e.g. if certain special characters would mess with the command line interface, enccrypted keys etc.) author: Florian Roth date: 2022/04/05 +modified: 2022/04/08 references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/d logsource: