security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: apply suggestions from code review

Browse Source 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
This commit is contained in:
Nasreddine Bencherchali
2023-07-17 12:04:58 +02:00
committed by GitHub
parent 6761b32a04
commit 981ceebab2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml
+3 -2
View File
@@ -1,10 +1,10 @@
title: Potential Registry Reconnaissance Via Powershell Script
title: Potential Registry Reconnaissance Via PowerShell Script
id: 064060aa-09fb-4636-817f-020a32aa7e9e
related:
- id: 970007b7-ce32-49d0-a4a4-fbef016950bd
type: similar
status: experimental
description: Detects PowerShell script with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
description: Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
author: frack113
@@ -20,6 +20,7 @@ logsource:
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
# TODO: switch to |re|i: after sigma specification v2 is released
ScriptBlockText|re: '(Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\(currentcontrolset\\services|CurrentVersion\\Policies\\Explorer\\Run|CurrentVersion\\Run|CurrentVersion\\ShellServiceObjectDelayLoad|CurrentVersion\\Windows\winlogon)\\'
condition: selection
falsepositives: