security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed category names and remove sysmon log source

Browse Source
This commit is contained in:
Florian Roth
2020-06-24 17:41:21 +02:00
parent e5f36dd146
commit f3fedef8f5
77 changed files with 31 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/sysmon_malware_verclsid_shellcode.yml
-1
View File
@@ -13,7 +13,6 @@ date: 2017/03/04
logsource:
category: process_access
product: windows
service: sysmon
definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
detection:
selection: