Skip to content

Commit 7310e50

Browse files
protectionsmachineprotectionsmachine
committed
Updating artifacts
1 parent aeb097e commit 7310e50

File tree

127 files changed

+2257
-1687
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

127 files changed

+2257
-1687
lines changed

‎behavior/rules/collection_getasynckeystate_api_call_from_suspicious_process.toml

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
[rule]
2+
description = """
3+
Identifies attempts to enumerate the state of keyboard keys by an unusual process. Adversaries may log user keystrokes
4+
to intercept credentials or other information from the user as the user types them.
5+
"""
6+
id = "be7140ba-4633-46a7-ac59-91cc85e5e252"
7+
license = "Elastic License v2"
8+
name = "GetAsyncKeyState API Call from Suspicious Process"
9+
os_list = ["windows"]
10+
reference = [
11+
"https://attack.mitre.org/techniques/T1056/001/",
12+
"https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getasynckeystate",
13+
]
14+
version = "1.0.6"
15+
16+
query = '''
17+
sequence by process.entity_id with maxspan=5m
18+
[process where event.action == "start" and
19+
(
20+
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
21+
(process.Ext.relative_file_creation_time <= 500 and (process.code_signature.trusted == false or process.code_signature.exists == false)) or
22+
process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe") or
23+
process.pe.original_file_name : ("python*.exe", "AutoIt*.exe") or
24+
(process.Ext.relative_file_creation_time <= 500 and
25+
process.executable :
26+
("?:\\Users\\Public\\*",
27+
"?:\\Users\\*\\Downloads\\*",
28+
"?:\\Windows\\Temp\\*",
29+
"?:\\Windows\\Tasks\\*",
30+
"?:\\ProgramData\\*",
31+
"?:\\Windows\\Microsoft.NET\\*")) or
32+
process.executable : ("?:\\Users\\*\\AppData\\Local\\Temp\\7z*\\",
33+
"?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
34+
"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
35+
"?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or
36+
(process.parent.name : "svchost.exe" and process.parent.args : "Schedule")
37+
) and
38+
not process.executable :
39+
("?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
40+
"?:\\Program Files (x86)\\*.exe",
41+
"?:\\Program Files\\*.exe")
42+
]
43+
[api where process.Ext.api.name == "GetAsyncKeyState" and
44+
process.Ext.api.parameters.background_callcount >= 400 and process.Ext.api.parameters.ms_since_last_keyevent >= 100]
45+
'''
46+
47+
min_endpoint_version = "8.10.0"
48+
[[actions]]
49+
action = "kill_process"
50+
field = "process.entity_id"
51+
state = 0
52+
53+
[[optional_actions]]
54+
action = "rollback"
55+
field = "process.entity_id"
56+
state = 0
57+
58+
[[threat]]
59+
framework = "MITRE ATT&CK"
60+
[[threat.technique]]
61+
id = "T1056"
62+
name = "Input Capture"
63+
reference = "https://attack.mitre.org/techniques/T1056/"
64+
[[threat.technique.subtechnique]]
65+
id = "T1056.001"
66+
name = "Keylogging"
67+
reference = "https://attack.mitre.org/techniques/T1056/001/"
68+
69+
70+
71+
[threat.tactic]
72+
id = "TA0009"
73+
name = "Collection"
74+
reference = "https://attack.mitre.org/tactics/TA0009/"
75+
76+
[internal]
77+
min_endpoint_version = "8.10.0"

‎behavior/rules/collection_suspicious_input_capture_via_getasynckeystate_api.toml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
[rule]
2+
description = """
3+
Identifies multiple attempts to enumerate the state of keyboard keys by the same process and in a short period of time.
4+
Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.
5+
"""
6+
id = "2ed0570d-3fa4-45b1-b4f2-d7fcc827daf1"
7+
license = "Elastic License v2"
8+
name = "Suspicious Input Capture via GetAsyncKeyState API"
9+
os_list = ["windows"]
10+
reference = [
11+
"https://attack.mitre.org/techniques/T1056/001/",
12+
"https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getasynckeystate",
13+
]
14+
version = "1.0.6"
15+
16+
query = '''
17+
sequence by process.entity_id with maxspan=3s
18+
[api where process.Ext.api.name == "GetAsyncKeyState"]
19+
[api where process.Ext.api.name == "GetAsyncKeyState"]
20+
[api where process.Ext.api.name == "GetAsyncKeyState"]
21+
[api where process.Ext.api.name == "GetAsyncKeyState"]
22+
[api where process.Ext.api.name == "GetAsyncKeyState"]
23+
'''
24+
25+
min_endpoint_version = "8.10.0"
26+
optional_actions = []
27+
[[actions]]
28+
action = "kill_process"
29+
field = "process.entity_id"
30+
state = 0
31+
32+
[[threat]]
33+
framework = "MITRE ATT&CK"
34+
[[threat.technique]]
35+
id = "T1056"
36+
name = "Input Capture"
37+
reference = "https://attack.mitre.org/techniques/T1056/"
38+
[[threat.technique.subtechnique]]
39+
id = "T1056.001"
40+
name = "Keylogging"
41+
reference = "https://attack.mitre.org/techniques/T1056/001/"
42+
43+
44+
45+
[threat.tactic]
46+
id = "TA0009"
47+
name = "Collection"
48+
reference = "https://attack.mitre.org/tactics/TA0009/"
49+
50+
[internal]
51+
min_endpoint_version = "8.10.0"

‎behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml

+6-2
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,18 @@ id = "75b80e66-90d0-4ab6-9e6b-976f7d690906"
77
license = "Elastic License v2"
88
name = "Connection to Dynamic DNS Provider by an Unsigned Binary"
99
os_list = ["windows"]
10-
version = "1.0.29"
10+
version = "1.0.30"
1111

1212
query = '''
1313
sequence by process.entity_id with maxspan=1m
1414
/* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
1515
[process where event.action == "start" and user.id : "S-1-5-21-*" and
1616
not process.code_signature.trusted == true and
17-
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")]
17+
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and
18+
not process.hash.sha256 :
19+
("6cebce1ed45f77ca971281862cc9c9d0085dbc3504a9f1f9a717496cce51c829",
20+
"43bd0fa458004d384a31b9147218be267b978506784dd4da141d46195a3ea4d9",
21+
"18886da5d34be1f92ddf333c26f8c3a2b0be4da60a7ac4d795da233cbcd9e3bb")]
1822
[dns where
1923
dns.question.name :
2024
(

‎behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml

+9-5
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,15 @@ id = "c567240c-445b-4000-9612-b5531e21e050"
77
license = "Elastic License v2"
88
name = "Connection to WebService by a Signed Binary Proxy"
99
os_list = ["windows"]
10-
version = "1.0.37"
10+
version = "1.0.38"
1111

1212
query = '''
1313
sequence by process.entity_id with maxspan=5m
1414
[process where event.action == "start" and user.id : "S-1-5-21-*" and
1515
(
1616
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
1717
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
18-
"msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "dfsvc.exe", "net.exe") or
18+
"msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe") or
1919
process.pe.original_file_name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe",
2020
"vbc.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe",
2121
"RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe") or
@@ -46,7 +46,10 @@ sequence by process.entity_id with maxspan=5m
4646
"?:\\WINDOWS\\SYSTEM32\\EDGEHTML.dll,#141",
4747
"?:\\WINDOWS\\System32\\shell32.dll,SHCreateLocalServerRunDll",
4848
"?:\\PROGRA~2\\MICROS~2\\Office*\\*.CPL*",
49-
"?:\\Windows\\System32\\mshtml.dll,PrintHTML"))
49+
"?:\\Windows\\System32\\mshtml.dll,PrintHTML",
50+
"?:\\PROGRA~?\\MICROS~?\\Office??\\MLCFG32.CPL,@0",
51+
"AppXDeploymentExtensions.OneCore.dll,ShellRefresh")) and
52+
not process.parent.executable : ("C:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe", "C:\\Program Files (x86)\\Avaya\\Avaya one-X Agent\\OneXAgentUI.exe")
5053
]
5154
[dns where
5255
dns.question.name :
@@ -129,8 +132,9 @@ sequence by process.entity_id with maxspan=5m
129132
"i.ibb.co"
130133
) and
131134
/* common to use powershell script by Microsoft Cloud sysadmins */
132-
not (process.name : ("powershell.exe", "pwsh.exe") and
133-
dns.question.name : ("graph.microsoft.com", "*.sharepoint.com", "login.microsoftonline.com", "login.live.com", "raw.githubusercontent.com"))
135+
not (process.name : ("powershell.exe", "pwsh.exe", "javaw.exe") and
136+
dns.question.name : ("graph.microsoft.com", "*.sharepoint.com", "login.microsoftonline.com", "login.live.com", "raw.githubusercontent.com")) and
137+
not (dns.question.name : "rev-resolve.azurewebsites.net" and process.name : "wscript.exe")
134138
]
135139
'''
136140

‎behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml

+4-3
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
77
license = "Elastic License v2"
88
name = "Connection to WebService by an Unsigned Binary"
99
os_list = ["windows"]
10-
version = "1.0.35"
10+
version = "1.0.36"
1111

1212
query = '''
1313
sequence by process.entity_id with maxspan=5m
@@ -119,7 +119,8 @@ sequence by process.entity_id with maxspan=5m
119119
]
120120
'''
121121

122-
min_endpoint_version = "8.4.0"
122+
min_endpoint_version = "8.10.0"
123+
reputation = true
123124
[[actions]]
124125
action = "kill_process"
125126
field = "process.entity_id"
@@ -154,4 +155,4 @@ name = "Command and Control"
154155
reference = "https://attack.mitre.org/tactics/TA0011/"
155156

156157
[internal]
157-
min_endpoint_version = "8.4.0"
158+
min_endpoint_version = "8.10.0"

‎behavior/rules/command_and_control_ingress_tool_transfer_via_curl.toml

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ id = "336ada1c-69f8-46e8-bdd2-790c85429696"
77
license = "Elastic License v2"
88
name = "Ingress Tool Transfer via CURL"
99
os_list = ["windows"]
10-
version = "1.0.24"
10+
version = "1.0.25"
1111

1212
query = '''
1313
process where event.action == "start" and
@@ -32,7 +32,7 @@ process where event.action == "start" and
3232
not (process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.args_count == 1) and
3333
not process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\nsc*.tmp\\*.exe" and
3434
not process.command_line : "*curl -o \\\\.\\nul -v -I -L -s --connect-timeout*" and
35-
not process.args : ("https://mirror.init7.net/ctan/systems*", "https://*.ctan.org*") and
35+
not process.args : ("https://mirror.init7.net/ctan/systems*", "https://*.ctan.org*", "texlive/curl") and
3636
3737
/* avoid breaking privileged install */
3838
not user.id : "S-1-5-18"

‎behavior/rules/command_and_control_ingress_tool_transfer_via_powershell.toml

+9-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ id = "5abd98fb-ffbe-4cd6-9592-3cda7b155ff5"
77
license = "Elastic License v2"
88
name = "Ingress Tool Transfer via PowerShell"
99
os_list = ["windows"]
10-
version = "1.0.16"
10+
version = "1.0.17"
1111

1212
query = '''
1313
process where event.action == "start" and not user.id : "S-1-5-18" and
@@ -27,7 +27,14 @@ process where event.action == "start" and not user.id : "S-1-5-18" and
2727
2828
not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
2929
not (process.code_signature.subject_name : "Chocolatey Software, Inc." and process.code_signature.trusted == true) and
30-
not process.executable : ("?:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\*", "?:\\ProgramData\\chocolatey\\lib\\*")
30+
not process.executable : ("?:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\*",
31+
"?:\\ProgramData\\chocolatey\\lib\\*",
32+
"?:\\Users\\*\\AppData\\Local\\Temp\\ns*.tmp\\*.exe") and
33+
not process.hash.sha256 :
34+
("1aac95f980af717c580b1b32885f51e67f0c3631ca0e7cfb2908b75df9a3501c",
35+
"c73c4ac2a7cdc48829fe0f9d7ec91ca41c8b434490d4eb3205aad69c7aa3b921",
36+
"3655b300361f205778b3d998a158b7ffb962ede315d92c25c0735b7925b26d8e",
37+
"2aac5c0da14cce02f809e0619c17dcc42ed995898dfb43f8312a924dd6b62a8a")
3138
'''
3239

3340
min_endpoint_version = "8.4.0"

‎behavior/rules/credential_access_access_to_browser_credentials_from_suspicious_memory.toml

+7-3
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ id = "808395cd-fb50-4eba-846c-aabcf212c256"
77
license = "Elastic License v2"
88
name = "Access to Browser Credentials from Suspicious Memory"
99
os_list = ["windows"]
10-
version = "1.0.19"
10+
version = "1.0.20"
1111

1212
query = '''
1313
file where event.type == "access" and process.pid != 4 and
@@ -33,7 +33,10 @@ file where event.type == "access" and process.pid != 4 and
3333
process.code_signature.subject_name :
3434
("Trichilia Consultants Limited", "Bitdefender SRL", "Opera Norway AS", "FireEye, Inc.",
3535
"Mozilla Corporation", "Google LLC", "Rapid7 LLC", "Cybereason, Inc", "Watchdata Technologies Pte. Ltd.",
36-
"Cylance, Inc.", "Bromium, Inc.")) and
36+
"Cylance, Inc.", "Bromium, Inc.", "ONELAUNCH TECHNOLOGIES INC.", "philandro Software GmbH",
37+
"Eric R. Zimmerman", "CISCO SYSTEMS CANADA CO", "Cisco Systems, Inc.", "Fiserv", "Fiserv, Inc.",
38+
"Garmin International, Inc.")) and
39+
not (process.code_signature.trusted == true and process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
3740
not process.executable : "?:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe" and
3841
not _arraysearch(process.thread.Ext.call_stack, $entry,
3942
$entry.symbol_info : ("?:\\Program Files\\*.dll*",
@@ -44,7 +47,8 @@ file where event.type == "access" and process.pid != 4 and
4447
"?:\\Windows\\System32\\umppc*.dll*",
4548
"?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
4649
"?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
47-
"?:\\windows\\system32\\hmpalert.dll!*"))
50+
"?:\\windows\\system32\\hmpalert.dll!*",
51+
"\\Device\\Mup\\*"))
4852
'''
4953

5054
min_endpoint_version = "8.7.0"

‎behavior/rules/credential_access_autologons_access_attempt_via_registry.toml

+2-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ license = "Elastic License v2"
88
name = "AutoLogons Access Attempt via Registry"
99
os_list = ["windows"]
1010
reference = ["https://github.com/GhostPack/SharpUp/blob/master/SharpUp/Checks/RegistryAutoLogons.cs#L26"]
11-
version = "1.0.8"
11+
version = "1.0.9"
1212

1313
query = '''
1414
registry where event.action == "query" and process.executable != null and
@@ -23,6 +23,7 @@ registry where event.action == "query" and process.executable != null and
2323
"?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
2424
"?:\\Windows\\System32\\MusNotification.exe",
2525
"?:\\Windows\\SysWOW64\\MusNotification.exe",
26+
"?:\\Windows\\System32\\wsmprovhost.exe",
2627
"?:\\Windows\\regedit.exe",
2728
"?:\\Program Files\\*.exe",
2829
"?:\\Program Files (x86)\\*.exe",

‎behavior/rules/credential_access_failed_attempts_to_access_sensitive_files.toml

+7-3
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ license = "Elastic License v2"
88
name = "Failed Attempts to Access Sensitive Files"
99
os_list = ["windows"]
1010
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
11-
version = "1.0.21"
11+
version = "1.0.22"
1212

1313
query = '''
1414
any where event.category in ("registry", "file") and
@@ -38,10 +38,14 @@ any where event.category in ("registry", "file") and
3838
"?:\\Program Files (x86)\\*.exe",
3939
"?:\\Windows\\System32\\SearchProtocolHost.exe",
4040
"?:\\Windows\\System32\\svchost.exe",
41-
"?:\\Windows\\System32\\OpenSSH\\ssh.exe") and
41+
"?:\\Windows\\System32\\OpenSSH\\ssh.exe",
42+
"?:\\Windows\\System32\\OpenWith.exe",
43+
"\\Device\\Mup*") and
4244
not (process.code_signature.subject_name :
4345
("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "Bitdefender SRL",
44-
"McAfee, Inc.", "Serengeti Systems Incorporated", "nordvpn s.a.", "Kaspersky Lab", "JetBrains s.r.o.") and
46+
"McAfee, Inc.", "Serengeti Systems Incorporated", "nordvpn s.a.", "Kaspersky Lab", "JetBrains s.r.o.",
47+
"Illusive Networks LTD", "Ghisler Software GmbH", "Keeper Security Inc.", "Eric R. Zimmerman",
48+
"Galactic Advisors, Inc.") and
4549
process.code_signature.trusted == true) and
4650
not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
4751
user.id : "S-1-5-18" and process.code_signature.trusted == true)

‎behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml

+8-3
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ reference = [
1111
"https://adsecurity.org/?page_id=1821",
1212
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
1313
]
14-
version = "1.0.32"
14+
version = "1.0.33"
1515

1616
query = '''
1717
file where event.action == "open" and
@@ -41,11 +41,16 @@ file where event.action == "open" and
4141
"?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
4242
"?:\\Windows\\System32\\SrTasks.exe",
4343
"?:\\Windows\\System32\\rstrui.exe",
44-
"?:\\Windows\\System32\\RecoveryDrive.exe") and
44+
"?:\\Windows\\System32\\RecoveryDrive.exe",
45+
"?:\\Windows\\System32\\MRT.exe",
46+
"?:\\rsyncd\\bin\\rsync.exe",
47+
"?:\\PCBP\\wbps.exe",
48+
"?:\\Windows\\System32\\Robocopy.exe") and
4549
/* mounted OS install */
4650
not file.path : "?:\\?*\\Windows\\System32\\*" and
4751
48-
not (process.code_signature.subject_name : "ESET, spol. s r.o." and process.code_signature.trusted == true) and
52+
not (process.code_signature.subject_name : ("ESET, spol. s r.o.", "Commvault Systems, Inc.", "Eric R. Zimmerman") and
53+
process.code_signature.trusted == true) and
4954
5055
/* 8.6+ logs also failed access attempt which generate some noise */
5156
not event.outcome == "failure"

‎behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml

+8-6
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,14 @@ reference = [
1111
"https://adsecurity.org/?page_id=1821",
1212
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
1313
]
14-
version = "1.0.30"
14+
version = "1.0.31"
1515

1616
query = '''
1717
sequence by process.entity_id
1818
[process where event.action == "start" and
1919
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
2020
not (process.name : "cscript.exe" and process.command_line : "*Tanium*collectAdInfo.vbs*" and
2121
process.Ext.token.integrity_level_name == "system") and
22-
not (process.code_signature.subject_name : ("Check Point Software Technologies Ltd.", "AO Kaspersky Lab", "HCL America Inc.") and
23-
process.code_signature.trusted == true) and
2422
not (process.executable : "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif" and
2523
process.args : "?:\\Windows\\Provisioning\\Microsoft-Desktop-Provisioning-Diagnostic.dat") and
2624
not (process.parent.executable : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe" and process.name : "reg.exe") and
@@ -30,9 +28,13 @@ sequence by process.entity_id
3028
not process.hash.sha256 : "52f145a4ccc0f540a130bedbf04370a842daff1ee8d8361c75a8e0d21a88cf5a" and
3129
not (process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\windows\\system32\\msiexec.exe") and
3230
process.parent.executable : "?:\\windows\\sys*\\msiexec.exe" and process.args : "-Embedding" and process.parent.args : "/V") and
33-
not (process.code_signature.subject_name : ("Trend Micro, Inc.", "Komodo Laboratories LLC", "Speckled Jay LLC", "Tenable Inc.", "HCL America Inc.") and
34-
process.code_signature.trusted == true) and
35-
not process.hash.sha256 : ("8016595ed2344c5322ea8eac1ffd490994417b5c4c745668aa5731ba9129e9fd", "f7e5566741042ce7a10cf2847279a0dd845ea813fdcb090cd4ee2359584c1496")
31+
not (process.code_signature.trusted == true and
32+
process.code_signature.subject_name : ("Trend Micro, Inc.", "Komodo Laboratories LLC", "Speckled Jay LLC", "Tenable Inc.", "HCL America Inc.",
33+
"Kaspersky Lab*", "Check Point Software Technologies Ltd.", "AO Kaspersky Lab", "HCL America Inc.")) and
34+
not process.hash.sha256 :
35+
("8016595ed2344c5322ea8eac1ffd490994417b5c4c745668aa5731ba9129e9fd",
36+
"f7e5566741042ce7a10cf2847279a0dd845ea813fdcb090cd4ee2359584c1496",
37+
"c9283a6b825629e698915b5d948f669c325ea1eb5310a6ff03c640a77e5d6b46")
3638
]
3739
[registry where event.action == "query" and
3840
registry.path : "HKLM\\SAM\\SAM\\Domains\\Account\\*" and

0 commit comments

Comments
 (0)