security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4326 from securepeacock/patch-49

Browse Source 
feat: add new reference to iso mount rule
This commit is contained in:
Nasreddine Bencherchali
2023-06-23 10:04:05 +02:00
committed by GitHub
parent ee725107c3 59a673586c
commit eef461a5fc
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/file/file_event/file_event_win_iso_file_mount.yml
+1
View File
@@ -5,6 +5,7 @@ description: Detects the creation of a ISO file in the Outlook temp folder or in
references:
- https://twitter.com/Sam0x90/status/1552011547974696960
- https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
- https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
author: '@sam0x90'
date: 2022/07/30
tags: