fix backend bool conversion errors
This commit is contained in:
@@ -6,6 +6,7 @@ author: Nasreddine Bencherchali
|
||||
references:
|
||||
- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
|
||||
date: 2022/07/28
|
||||
modified: 2022/08/24
|
||||
logsource:
|
||||
product: windows
|
||||
category: driver_load
|
||||
@@ -22,7 +23,7 @@ detection:
|
||||
driver_img:
|
||||
ImageLoaded|endswith: '\aswArPot.sys'
|
||||
driver_status:
|
||||
- Signed: false
|
||||
- Signed: 'false'
|
||||
- SignatureStatus: Expired
|
||||
condition: 1 of selection* or all of driver_*
|
||||
falsepositives:
|
||||
|
||||
+2
-2
@@ -6,7 +6,7 @@ author: Roberto Rodriguez @Cyb3rWard0g
|
||||
references:
|
||||
- https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
|
||||
date: 2019/09/12
|
||||
modified: 2022/08/16
|
||||
modified: 2022/08/24
|
||||
logsource:
|
||||
category: network_connection
|
||||
product: windows
|
||||
@@ -15,7 +15,7 @@ detection:
|
||||
DestinationPort:
|
||||
- 5985
|
||||
- 5986
|
||||
Initiated: true # only matches of the initiating system can be evaluated
|
||||
Initiated: 'true' # only matches of the initiating system can be evaluated
|
||||
filter:
|
||||
- User|contains: # covers many language settings for Network Service, please expand
|
||||
- 'NETWORK SERVICE'
|
||||
|
||||
Reference in New Issue
Block a user