SEKOIA.IO Rules medium experimental sigma

PowerShell invoking in the command line a registry value to execute.

Detects a d9114938 execution which grabs a value in the windows registry to execute it.

View Source

Detection Logic

{
  "selection": {
    "Image
| contains": "powershell",
    "CommandLine
| contains": "HKCU"
  },
  "selection2": {
    "CommandLine
| contains": [
      "gp",
      "Get-ItemProperty"
    ]
  },
  "condition": "selection and selection2"
}

Field Validations

Loading…

Comments (0)

Loading comments...