Improved regsvr32 whitelisting bypass rule

2017-06-07 12:02:55 +02:00
parent 1fd7a92e87
commit e5ad1b2f84
1 changed files with 2 additions and 1 deletions
@@ -20,9 +20,10 @@ detection:
    selection3:
        EventID: 1
        Image: '*\regsvr32.exe'
-        Commandline: '/i:http'
+        Commandline: '*/i:http* scrobj.dll'
    condition: selection1 or selection2 or selection3
 falsepositives:
    - Unknown
 level: high

+