Sigma medium test sigma

Suspicious Application Installed

Detects suspicious application installed by looking at the added shortcut to the app resolver cache

View Source

Detection Logic

{
  "selection_name": {
    "EventID": 28115,
    "Name
| contains": [
      "Zenmap",
      "AnyDesk",
      "wireshark",
      "openvpn"
    ]
  },
  "selection_packageid": {
    "EventID": 28115,
    "AppID
| contains": [
      "zenmap.exe",
      "prokzult ad",
      "wireshark",
      "openvpn"
    ]
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Packages or applications being legitimately used by users or administrators

Field Validations

Loading…

Comments (0)

Loading comments...