security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Connection to Commonly Abused Web Services (#2728)

Browse Source 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2023-04-20 18:26:00 -03:00
committed by GitHub
parent b1e3215cd5
commit 255c53cff0
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/command_and_control_common_webservices.toml
+3 -3
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/04/17"
updated_date = "2023/04/20"
[transform]
[[transform.osquery]]
@@ -157,12 +157,12 @@ network where host.os.type == "windows" and network.protocol == "dns" and
/* Discord App */
(process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
process.code_signature.trusted == true) and not dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
) or
/* MS Sharepoint */
(process.name : "Microsoft.SharePoint.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
process.code_signature.trusted == true) and not dns.question.name : "onedrive.live.com"
process.code_signature.trusted == true) and dns.question.name : "onedrive.live.com"
) or
/* Firefox */