security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Modification of WDigest Security Provider (#2201)

Browse Source 
excluding svchost.exe running as system (main src of FPs for this use case).
This commit is contained in:
Samirbous
2022-07-29 19:45:33 +02:00
committed by GitHub
parent b2b5c170dd
commit 6d61a68c29
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/credential_access_mod_wdigest_security_provider.toml
+3 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/19"
maturity = "production"
updated_date = "2022/05/09"
updated_date = "2022/07/29"
[rule]
author = ["Elastic"]
@@ -93,7 +93,8 @@ query = '''
registry where event.type : ("creation", "change") and
registry.path :
"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
and registry.data.strings : ("1", "0x00000001")
and registry.data.strings : ("1", "0x00000001") and
not (process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
'''