security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3370 from redsand/fp_missing_contains_all

Browse Source 
False positive fix, needs to match ALL of selectioN_delete, not 1 of …
This commit is contained in:
frack113
2022-08-13 07:47:34 +02:00
committed by GitHub
parent 15f94c4685 fa522f68c9
commit 7bebb9929b
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml
+3 -2
View File
@@ -4,8 +4,9 @@ status: experimental
description: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products
references:
- https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
author: Nasreddine Bencherchali
author: Nasreddine Bencherchali, Tim Shelton
date: 2022/08/08
modified: 2022/08/12
logsource:
category: process_creation
product: windows
@@ -14,7 +15,7 @@ detection:
- Image|endswith: 'reg.exe'
- OriginalFileName: 'reg.exe'
selection_delete:
CommandLine|contains:
CommandLine|contains|all:
- ' delete '
- '\SYSTEM\CurrentControlSet\Control\SafeBoot'
condition: all of selection*