[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta"; program:*Sysmon*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id:12,13,14; content:"\\CurrentControlSet\\Control\\SafeBoot\\Network\\Fax"; nocase; reference:url,www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence; classtype:trojan-activity; sid:5010225; metadata: created_on 2022_11_22, old_sid 5008399; rev:2;)