Sagan critical stable other

[WINDOWS-SYSMON] Blackbasta default icon registry entry

[WINDOWS-SYSMON] Blackbasta default icon registry entry

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Blackbasta default icon registry entry"; program:*Sysmon*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id:12,13,14; content:"\.basta\\DefaultIcon"; reference:url,www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence; classtype:trojan-activity; sid:5010223; metadata: created_on 2022_11_22, old_sid 5008397; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...