Anvilogic high experimental other

1 or 2 Character Executable [snowflake-crowdstrikefdr_process]

Adversaries have been known to occasionally use executable files named with only 1 or 2 word characters. - Threat Actor Association: Lotus Blossom, OilRig, Trigona, Volt Typhoon

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process_path, '.*\\\x5c\\\w{1,2}\\\.exe.*', 'i') and not regexp_like(process_path, '.*windows\\\x5c(system32
| syswow64)\\\x5csc.exe.*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...