security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update and rename rules/windows/other/win_Outlook_C2_Macro_Creation.yml to rules/windows/file_event/win_outlook_c2_macro_creation.yml

Browse Source
This commit is contained in:
Florian Roth
2021-05-04 09:36:26 +02:00
committed by GitHub
parent 678ce5d528
commit 8973b573bd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/other/win_Outlook_C2_Macro_Creation.yml → rules/windows/file_event/win_outlook_c2_macro_creation.yml
+2 -2
View File
@@ -1,7 +1,7 @@
title: BEC - Outlook C2 Macro Creation
title: Outlook C2 Macro Creation
id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
status: experimental
description: Detects the creation of a macro file for Outlook. Goes with win_Outlook_C2_Registry_Key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events (Registry & File Creation happens at the same time.
description: Detects the creation of a macro file for Outlook. Goes with win_outlook_c2_registry_key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events Registry & File Creation happens at the same time.
references:
- https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
author: '@ScoubiMtl'