security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-12-09 13:41:21 +01:00
parent 0783d6df22 ac706c5f56
commit 559b4c4e97
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/security/win_security_susp_scheduled_task_delete.yml
+5 -3
View File
@@ -12,7 +12,7 @@ references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701
author: Nasreddine Bencherchali
date: 2022/12/05
modified: 2022/12/08
modified: 2022/12/09
tags:
- attack.execution
- attack.privilege_escalation
@@ -36,8 +36,10 @@ detection:
- '\Windows\WindowsUpdate\'
- '\Windows\UpdateOrchestrator\'
- '\Windows\ExploitGuard'
filter_ac_power_download:
Task|contains: '\Windows\UpdateOrchestrator\AC Power Download'
filter_ac_power_download:
Task|contains: '\Windows\UpdateOrchestrator\AC Power Download'
filter_sys_username:
SubjectUserName|endswith: '$' # False positives during upgrades of Defender, where its tasks get removed and added
condition: selection and not 1 of filter_*
falsepositives:
- Unknown