Sagan high stable other

[WINDOWS-SYSMON] Evilginx2 Certificate Operations

[WINDOWS-SYSMON] Evilginx2 Certificate Operations

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Evilginx2 Certificate Operations"; program:*Sysmon*; event_id:1; content:"CommandLine"; pcre:"/CommandLine:.*(certbot
| acme
| letsencrypt).*(evilginx
| phish)/i"; classtype:suspicious-command; reference:url,github.com/kgretzky/evilginx2; sid:5015980; rev:1; metadata:created_at 2025_05_23, mitre_tactic_id TA0001, mitre_technique_id T1566.002;)

Field Validations

Loading…

Comments (0)

Loading comments...