regsvr32 Anomalies

2017-04-16 12:02:29 +02:00
parent 769156a83b
commit a5c3f424c1
1 changed files with 21 additions and 0 deletions
@@ -0,0 +1,21 @@
+title: Regsvr32 Anomaly
+status: experimental
+description: Detects various anomalies in relation to regsvr32.exe
+author: Florian Roth
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection1:
+        EventID: 1
+        Image: '*\regsvr32.exe'
+        CommandLine: '*\Temp\*'
+    selection2:
+        EventID: 1
+        Image: '*\regsvr32.exe'
+        ParentImage: '*\powershell.exe'
+    condition: any of them
+falsepositives:
+    - Unknown
+level: high
+