security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Persistence via TelemetryController Scheduled Task Hijack (#655)

Browse Source 
* [Rule Tuning] Persistence via TelemetryController Scheduled Task Hijack

* ecs_version
This commit is contained in:
Samirbous
2020-12-03 22:59:46 +01:00
committed by GitHub
parent 11041e0012
commit 41dd58b151
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml
+2 -2
View File
@@ -25,8 +25,8 @@ type = "query"
query = '''
event.category:process and event.type:(start or process_started) and
process.parent.name:(CompatTelRunner.exe or compattelrunner.exe) and
not process.name:(conhost.exe or DeviceCensus.exe or devicecensus.exe or CompatTelRunner.exe or compattelrunner.exe or DismHost.exe or dismhost.exe or rundll32.exe)
process.parent.name:(CompatTelRunner.exe or compattelrunner.exe) and process.args:-cv* and
not process.name:(conhost.exe or DeviceCensus.exe or devicecensus.exe or CompatTelRunner.exe or compattelrunner.exe or DismHost.exe or dismhost.exe or rundll32.exe or powershell.exe)
'''