Merge pull request #2895 from SigmaHQ/aurora-false-positive-fixing

fix: removed base64 encoded param rule - too many FPs
2022-04-09 19:40:04 +02:00
parent e8378779ea 87d06a4f6d
commit a46b6d751c
1 changed files with 0 additions and 22 deletions
@@ -1,22 +0,0 @@
-title: Base64 Encoded Command Line Param Indicator
-id: eee65975-bfb8-41e6-af33-18011ba24c99
-status: experimental
-description: Detects programs that use base64 encoded values provided via command line, which is often an indicator of obfuscation but could also be used for legitimate purposes (e.g. if certain special characters would mess with the command line interface, enccrypted keys etc.)
-author: Florian Roth
-date: 2022/04/05
-modified: 2022/04/08
-references:
-   - https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/d
-logsource:
-   product: windows
-   category: process_creation
-detection:
-   selection:
-      - CommandLine|endswith: '=='
-      - CommandLine|contains: '== -'
-   filter:
-      Image|endswith: '\VeeamAgent.exe'
-   condition: selection and not 1 of filter*
-falsepositives:
-   - Legitimate software that uses base64 encoded values in its command line
-level: medium