Sagan high stable other

[WINDOWS-SYSMON] Attack on Sysmon - SysmonDrv Registry value set

[WINDOWS-SYSMON] Attack on Sysmon - SysmonDrv Registry value set

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Attack on Sysmon - SysmonDrv Registry value set"; program:*Sysmon*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id:12,13; content:"EventType: setValue"; nocase; content:"Targetobject
| 3a
| "; nocase; content:"\\SysmonDrv\\"; nocase; distance:0; reference:url,codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html; reference:url,github.com/matterpreter/Shhmon; reference:url,talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html; classtype:suspicious-command; sid:5009799; metadata: created_on 2022_11_22, old_sid 5007697; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...