security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanup win_malware_conti_shadowcopy.yml

Browse Source
This commit is contained in:
frack113
2021-08-16 09:21:04 +02:00
committed by GitHub
parent ed424c55c8
commit 5b09dff1fb
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/win_malware_conti_shadowcopy.yml
+1 -2
View File
@@ -11,8 +11,7 @@ logsource:
product: windows
detection:
selection_1:
CommandLine|contains:
- '\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy'
CommandLine|contains: '\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy'
selection_2:
CommandLine|contains:
- '\\NTDS.dit'