Sagan critical stable other

[WINDOWS-SYSMON] Blackbasta default icon registry entry

[WINDOWS-SYSMON] Blackbasta default icon registry entry

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Blackbasta default icon registry entry"; program:*Sysmon*; event_id:12,13,14; content:"\.basta\DefaultIcon"; reference:url,www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence; classtype:trojan-activity; sid:5008397; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...