fix backend bool conversion errors

This commit is contained in:
Yamato Security
2022-08-24 09:23:35 +09:00
parent 4e3fc80ee8
commit 1faef2fa97
2 changed files with 4 additions and 3 deletions
@@ -6,6 +6,7 @@ author: Nasreddine Bencherchali
references:
- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
date: 2022/07/28
modified: 2022/08/24
logsource:
product: windows
category: driver_load
@@ -22,7 +23,7 @@ detection:
driver_img:
ImageLoaded|endswith: '\aswArPot.sys'
driver_status:
- Signed: false
- Signed: 'false'
- SignatureStatus: Expired
condition: 1 of selection* or all of driver_*
falsepositives:
@@ -6,7 +6,7 @@ author: Roberto Rodriguez @Cyb3rWard0g
references:
- https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
date: 2019/09/12
modified: 2022/08/16
modified: 2022/08/24
logsource:
category: network_connection
product: windows
@@ -15,7 +15,7 @@ detection:
DestinationPort:
- 5985
- 5986
Initiated: true # only matches of the initiating system can be evaluated
Initiated: 'true' # only matches of the initiating system can be evaluated
filter:
- User|contains: # covers many language settings for Network Service, please expand
- 'NETWORK SERVICE'