Sagan critical stable other

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta"; program:*Sysmon*; event_id:12,13,14; content:"\CurrentControlSet\Control\SafeBoot\Network\Fax"; nocase; reference:url,www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence; classtype:trojan-activity; sid:5008399; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...