security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2431 from frack113/ft_aurora

Browse Source 
FP  perfmon.exe to sysmon_cred_dump_lsass_access.yml
This commit is contained in:
frack113
2021-12-11 12:29:12 +01:00
committed by GitHub
parent c91a4a1a75 58063d1113
commit 2b6c8ff02c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/sysmon_cred_dump_lsass_access.yml
+2 -1
View File
@@ -5,7 +5,7 @@ description: Detects process access LSASS memory which is typical for credential
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov,
oscd.community (update)
date: 2017/02/16
modified: 2021/12/04
modified: 2021/12/10
references:
- https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
@@ -40,6 +40,7 @@ detection:
filter1:
SourceImage:
- 'C:\WINDOWS\system32\taskmgr.exe'
- 'C:\Windows\System32\perfmon.exe'
filter2:
SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
SourceImage|endswith: '\MsMpEng.exe'