security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2383 from SigmaHQ/aurora-false-positive-fixing

Browse Source 
Aurora false positive fixing
This commit is contained in:
Florian Roth
2021-12-04 22:12:10 +01:00
committed by GitHub
parent 7cd747ff40 b6c8481a84
commit cbe136b926
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/sysmon_cred_dump_lsass_access.yml
+5 -2
View File
@@ -5,7 +5,7 @@ description: Detects process access LSASS memory which is typical for credential
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov,
oscd.community (update)
date: 2017/02/16
modified: 2021/12/03
modified: 2021/12/04
references:
- https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
@@ -64,7 +64,10 @@ detection:
SourceImage: 'C:\WINDOWS\system32\svchost.exe'
GrantedAccess: '0x100000'
filter7:
SourceImage: 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
SourceImage:
- 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
- 'C:\Windows\syswow64\MsiExec.exe'
- 'C:\Windows\System32\msiexec.exe'
GrantedAccess:
- '0x1410'
- '0x410'