security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Suspicious DLL Loaded for Persistence or Privilege Escalation (#5039)

Browse Source
This commit is contained in:
Jonhnathan
2025-09-01 05:09:31 -07:00
committed by GitHub
parent d9151c30ae
commit dd918b1f80
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/privilege_escalation_persistence_phantom_dll.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/01/07"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2025/05/05"
updated_date = "2025/08/29"
[rule]
author = ["Elastic"]
@@ -106,8 +106,8 @@ any where host.os.type == "windows" and
?dll.code_signature.trusted != true or
?dll.code_signature.exists != true or
(
dll.code_signature.trusted == true and
not dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation", "Microsoft Windows Publisher")
?dll.code_signature.trusted == true and
not ?dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation", "Microsoft Windows Publisher")
)
) or
/* oci.dll is too noisy due to unsigned Oracle related DLL loaded from random dirs */