Merge pull request #3088 from pH-T/master

new rules for msdt cloaking
2022-06-03 17:09:44 +02:00
parent c2c1a2dcb7 07628f6795
commit cdc06238cd
1 changed files with 23 additions and 0 deletions
@@ -0,0 +1,23 @@
+title: Renamed Msdt.exe
+id: bd1c6866-65fc-44b2-be51-5588fcff82b9
+status: experimental
+description: Detects process creation with a renamed Msdt.exe
+author: pH-T
+date: 2022/06/03
+references:
+   - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
+tags:
+   - attack.defense_evasion
+   - attack.t1036.003
+logsource:
+   category: process_creation
+   product: windows
+detection:
+   selection:
+      OriginalFileName: 'msdt.exe'
+   filter_realmsdt:
+      Image|endswith: '\msdt.exe'
+   condition: selection and not 1 of filter*
+falsepositives:
+    - Unlikely
+level: high