security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update proc_creation_win_lolbin_sideload_link_binary.yml

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-08-22 20:17:22 +01:00
parent 6aa4c56b3b
commit c9e81f1cf0
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_lolbin_sideload_link_binary.yml
+1 -2
View File
@@ -15,8 +15,7 @@ logsource:
detection:
selection:
Image|endswith: '\link.exe'
CommandLine|contains:
- 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
CommandLine|contains: 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
# Add other filters for other legitimate locations
filter_visual_studio:
ParentImage|startswith: