fix: wpad decision matches

This commit is contained in:
Florian Roth
2022-03-29 19:46:45 +02:00
parent 658f4c48ee
commit 9d0483697c
@@ -3,7 +3,7 @@ id: d88d0ab2-e696-4d40-a2ed-9790064e66b3
description: Detects the modification of the registry settings used for Internet Explorer and other Windows components that use these settings
author: frack113
date: 2022/01/22
modified: 2022/03/25
modified: 2022/03/29
status: experimental
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
@@ -25,6 +25,7 @@ detection:
TargetObject|contains:
- '\Cache'
- '\ZoneMap'
- '\WpadDecision'
filter_binary:
Details: 'Binary Data'
condition: selection_domains and not 1 of filter_*