security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Sensitive Registry Hive Access via RegBack (#3947)

Browse Source 
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2024-08-01 14:06:08 -03:00
committed by GitHub
parent 485312d5f2
commit 8d3ec2b8a3
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/credential_access_regback_sam_security_hives.toml
+5 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/07/01"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/07/01"
updated_date = "2024/08/01"
[rule]
author = ["Elastic"]
@@ -70,7 +70,10 @@ file where host.os.type == "windows" and
("?:\\Windows\\System32\\config\\RegBack\\SAM",
"?:\\Windows\\System32\\config\\RegBack\\SECURITY",
"?:\\Windows\\System32\\config\\RegBack\\SYSTEM") and
not (user.id == "S-1-5-18" and process.executable : "?:\\Windows\\system32\\taskhostw.exe")
not (
user.id == "S-1-5-18" and process.executable : (
"?:\\Windows\\system32\\taskhostw.exe", "?:\\Windows\\system32\\taskhost.exe"
))
'''