security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Svchost spawning Cmd - False Positives Tuning (#1894)

Browse Source 
(cherry picked from commit e1b4a0d87c)
This commit is contained in:
Jonhnathan
2022-03-31 19:28:46 -03:00
committed by github-actions[bot]
parent 4ed2fbe932
commit 8d322f40c0
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/execution_command_shell_started_by_svchost.toml
+9 -3
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2021/04/14"
updated_date = "2022/03/28"
[rule]
author = ["Elastic"]
@@ -19,9 +19,15 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type in ("start", "process_started") and
process where event.type == "start" and
process.parent.name : "svchost.exe" and process.name : "cmd.exe" and
not (process.pe.original_file_name == "Cmd.Exe" and process.args : "?:\\Program Files\\Npcap\\CheckStatus.bat??")
not (process.pe.original_file_name : "cmd.exe" and process.args : (
"??:\\Program Files\\Npcap\\CheckStatus.bat?",
"?:\\Program Files\\Npcap\\CheckStatus.bat",
"\\system32\\cleanmgr.exe",
"?:\\Windows\\system32\\silcollector.cmd",
"\\system32\\AppHostRegistrationVerifier.exe",
"\\system32\\ServerManagerLauncher.exe"))
'''