Sigma high test sigma

GALLIUM Artefacts - Builtin

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

View Source

Detection Logic

{
  "selection": {
    "EventID": 257,
    "QNAME": [
      "asyspy256.ddns.net",
      "hotkillmail9sddcc.ddns.net",
      "rosaf112.ddns.net",
      "cvdfhjh1231.myftp.biz",
      "sz2016rose.ddns.net",
      "dffwescwer4325.myftp.biz",
      "cvdfhjh1231.ddns.net"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...