rule: DumpStack.log Defender evasion

2022-01-07 08:46:30 +01:00
parent 985bc78d0d
commit dfa7938f17
1 changed files with 22 additions and 0 deletions
@@ -0,0 +1,22 @@
+title: DumpStack.log Defender Evasion
+id: 4f647cfa-b598-4e12-ad69-c68dd16caef8
+status: experimental
+description: Detects the use of the filename DumpStack.log to evade Microsoft Defender
+references:
+    - https://twitter.com/mrd0x/status/1479094189048713219
+tags:
+    - attack.defense_evasion
+author: Florian Roth
+date: 2022/01/06
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\DumpStack.log'
+    selection_download:
+        CommandLine: ' -o DumpStack.log'
+    condition: 1 of selection*
+falsepositives:
+    - Unknown
+level: critical