change OriginalFilename case

This commit is contained in:
frack113
2021-07-06 10:09:47 +02:00
parent 4b487f49fc
commit cfccdea28e
2 changed files with 4 additions and 2 deletions
@@ -4,6 +4,7 @@ status: experimental
description: Detect
author: Florian Roth
date: 2021/06/18
modified: 2021/07/06
references:
- https://github.com/mvelazc0/PurpleSharp
logsource:
@@ -15,7 +16,7 @@ detection:
- xyz123456.exe
- PurpleSharp
selection2:
OriginalFilename:
OriginalFileName:
- 'PurpleSharp.exe'
condition: selection1 or selection2
falsepositives:
@@ -6,6 +6,7 @@ references:
- https://www.poweradmin.com/paexec/
author: Florian Roth
date: 2021/05/22
modified: 2021/07/06
logsource:
category: process_creation
product: windows
@@ -13,7 +14,7 @@ detection:
selection1:
Description: 'PAExec Application'
selection2:
OriginalFilename: 'PAExec.exe'
OriginalFileName: 'PAExec.exe'
filter:
Image|endswith:
- '\PAexec.exe'