change OriginalFilename case
This commit is contained in:
@@ -4,6 +4,7 @@ status: experimental
|
||||
description: Detect
|
||||
author: Florian Roth
|
||||
date: 2021/06/18
|
||||
modified: 2021/07/06
|
||||
references:
|
||||
- https://github.com/mvelazc0/PurpleSharp
|
||||
logsource:
|
||||
@@ -15,7 +16,7 @@ detection:
|
||||
- xyz123456.exe
|
||||
- PurpleSharp
|
||||
selection2:
|
||||
OriginalFilename:
|
||||
OriginalFileName:
|
||||
- 'PurpleSharp.exe'
|
||||
condition: selection1 or selection2
|
||||
falsepositives:
|
||||
|
||||
@@ -6,6 +6,7 @@ references:
|
||||
- https://www.poweradmin.com/paexec/
|
||||
author: Florian Roth
|
||||
date: 2021/05/22
|
||||
modified: 2021/07/06
|
||||
logsource:
|
||||
category: process_creation
|
||||
product: windows
|
||||
@@ -13,7 +14,7 @@ detection:
|
||||
selection1:
|
||||
Description: 'PAExec Application'
|
||||
selection2:
|
||||
OriginalFilename: 'PAExec.exe'
|
||||
OriginalFileName: 'PAExec.exe'
|
||||
filter:
|
||||
Image|endswith:
|
||||
- '\PAexec.exe'
|
||||
|
||||
Reference in New Issue
Block a user