Sagan high stable other

[WINDOWS-SYSMON] SYSMON Possible CMD detected

[WINDOWS-SYSMON] SYSMON Possible CMD detected

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] SYSMON Possible CMD detected"; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 1; pcre: "/CommandLine: (.*)cmd(.*)/i"; content: "OriginalFileName
| 22
| :
| 22
| Cmd.Exe
| 22
| "; nocase; classtype: suspicious-command; program: *Sysmon*; reference: url,findingbad.blogspot.cz/2017/12/a-few-of-my-favorite-things-continued.html; reference: url,www.quadrantsec.com/about/blog/using_jack_crooks_log_analysis_concepts_with_sagan; sid:5009792; metadata: created_on 2022_11_22, old_sid 5003388; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...