Hayabusa medium test sigma

Potential Regsvr32 Commandline Flag Anomaly

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection": {
    "CommandLine
| contains
| windash": " -i:",
    "NewProcessName
| endswith": "\\regsvr32.exe"
  },
  "filter_main_flag": {
    "CommandLine
| contains
| windash": " -n "
  },
  "condition": "process_creation and (selection and not 1 of filter_main_*)"
}

False Positives

⚠ Administrator typo might cause some false positives

Field Validations

Loading…

Comments (0)

Loading comments...