Sagan high stable other

[WINDOWS-SYSMON] Attack on Sysmon - SysmonEnte Detected

[WINDOWS-SYSMON] Attack on Sysmon - SysmonEnte Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Attack on Sysmon - SysmonEnte Detected"; program:*Sysmon*; event_id:10; content:"TargetImage
| 3a
| "; nocase; meta_content:"%sagan%",sysmon.exe,sysmon64.exe; meta_distance:0; meta_nocase; content:"CallTrace
| 3a
| Ente"; nocase; reference:url,codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html; reference:url,github.com/matterpreter/Shhmon; classtype:suspicious-command; sid:5007699; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...