security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adding filter for msiexec repair option

Browse Source
This commit is contained in:
Tim Shelton
2021-12-09 15:16:52 +00:00
parent 6edd674a55
commit 88eaeca844
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/sysmon_always_install_elevated_windows_installer.yml
+4 -2
View File
@@ -4,7 +4,7 @@ description: This rule looks for Windows Installer service (msiexec.exe) trying
status: experimental
author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
date: 2020/10/13
modified: 2021/08/26
modified: 2021/12/09
references:
- https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg
tags:
@@ -29,7 +29,9 @@ detection:
image_2:
Image|endswith:
- '\msiexec.exe'
condition: (image_1 and user) or (image_2 and user and integrity_level)
image_2_flush:
Command|endswith: '\system32\msiexec.exe /V' # ignore "repair option"
condition: (image_1 and user) or (image_2 and user and integrity_level and not image_2_flush )
fields:
- IntegrityLevel
- User