security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2372 from redsand/fp_sysmon_config_err

Browse Source 
adding filter for benign error from sysmon configuration
This commit is contained in:
frack113
2021-12-03 13:15:14 +01:00
committed by GitHub
parent 34c697cead fc2e2aa4c5
commit 65eeb01a13
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/sysmon/sysmon_config_modification_error.yml
+4 -4
View File
@@ -4,7 +4,7 @@ description: Someone try to hide from Sysmon
status: experimental
author: frack113
date: 2021/06/04
modified: 2021/11/12
modified: 2021/12/02
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
@@ -20,8 +20,8 @@ detection:
- 'Failed to open service configuration with error'
- 'Failed to connect to the driver to update configuration'
selection_filter:
Description: 'Failed to open service configuration with error 19'
condition: selection_error
Description: 'Failed to open service configuration with error 19 - Last error: The media is write protected.'
condition: selection_error and not selection_filter
falsepositives:
- legitimate administrative action
level: high
level: high