Merge pull request #2790 from frack113/malware_dropper

Add file_event_win_susp_dropper
2022-03-11 06:27:49 +01:00
parent bfd5d71256 3cb0640192
commit 94d7ef2e7f
1 changed files with 23 additions and 0 deletions
@@ -0,0 +1,23 @@
+title: Suspicious Creation Of a Exe By a Exe
+id: 297afac9-5d02-4138-8c58-b977bac60556
+status: experimental
+description: A executable drop another executable
+author: frack113
+references:
+  - Malware Sandbox
+date: 2022/03/09
+logsource:
+  product: windows
+  category: file_event
+detection:
+  selection:
+    Image|endswith: '.exe'
+    TargetFilename|endswith: '.exe'
+  condition: selection 
+falsepositives:
+  - Unknown
+#Please contribute to FP to go up the level
+level: low
+tags:
+  - attack.resource_development
+  - attack.t1587.001