Merge pull request #45 from secman-pl/patch-1

Update sysmon_susp_regsvr32_anomalies to detect wscript child process
2017-09-10 22:52:37 +02:00
parent bfe8378455 9768f275d0
commit 68cb5e8921
1 changed files with 7 additions and 1 deletions
@@ -24,7 +24,13 @@ detection:
        Commandline: 
            - '*/i:http* scrobj.dll'
            - '*/i:ftp* scrobj.dll'
-    condition: selection1 or selection2 or selection3
+    # Regsvr32.exe spawned wscript.exe process - indicator of COM scriptlet
+    # https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100
+    selection4:
+        EventID: 1
+        Image: '*\wscript.exe'
+        ParentImage: '*\regsvr32.exe'
+    condition: selection1 or selection2 or selection3 or selection4
 falsepositives:
    - Unknown
 level: high