Tune false positive

2021-07-27 09:58:00 +02:00
parent cf221c08c8
commit f3bcffeb0a
1 changed files with 3 additions and 1 deletions
@@ -4,17 +4,19 @@ status: experimental
 description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
 references:
    - https://twitter.com/_vivami/status/1347925307643355138
+    - https://vanmieghem.io/stealth-outlook-persistence/
 tags:
    - attack.t1137.006
    - attack.persistence
 author: Bhabesh Raj
 date: 2021/01/10
-modified: 2021/06/01
+modified: 2021/07/27
 logsource:
    category: registry_event
    product: windows
 detection:
    selection:
+        EventType: SetValue
        TargetObject|contains:
        - '\Software\Microsoft\Office\Outlook\Addins\'
        - '\Software\Microsoft\Office\Word\Addins\'