security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Suspicious Antimalware Scan Interface DLL (#3432)

Browse Source 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2024-02-08 06:27:16 -03:00
committed by GitHub
parent 827dfa7327
commit 21b559c97f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["windows", "endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/30"
updated_date = "2024/02/06"
[transform]
[[transform.osquery]]
@@ -108,7 +108,7 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "windows" and event.action != "deletion" and file.path != null and
file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
file.name : ("amsi.dll", "amsi") and not file.path : ("?:\\Windows\\system32\\amsi.dll", "?:\\Windows\\Syswow64\\amsi.dll", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*", "?:\\$WINDOWS.~BT\\Work\\*\\*", "?:\\Windows\\SoftwareDistribution\\Download\\*")
'''