Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added some ASEPs

Browse Source
This commit is contained in:
Eric Conrad
2021-10-29 16:25:45 -04:00
committed by GitHub
parent 45d62cbfbe
commit e3bf84fe51
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
regexes.txt
View File

@ -23,5 +23,8 @@ Type,regex,string
# Generic cvtres.exe alert, comment out if experiencing false positives # Generic cvtres.exe alert, comment out if experiencing false positives
0,\\cvtres\.exe.*,Resource File To COFF Object Conversion Utility cvtres.exe 0,\\cvtres\.exe.*,Resource File To COFF Object Conversion Utility cvtres.exe
0,\\cvtres\.exe.*\\AppData\\Local\\Temp\\[A-Z0-9]{7}\.tmp,PSAttack-style command via cvtres.exe 0,\\cvtres\.exe.*\\AppData\\Local\\Temp\\[A-Z0-9]{7}\.tmp,PSAttack-style command via cvtres.exe
0,Register-ScheduledTask,Command referencing Register-ScheduledTask (possible ASEP)
0,Software\\Microsoft\\Windows\\CurrentVersion\\Run,Reference to registry run key (possible ASEP)
0,reg *add,Registry addition (possible ASEP)
1,^[a-zA-Z]{22}$,Metasploit-style service name: 22 characters, [A-Za-z] 1,^[a-zA-Z]{22}$,Metasploit-style service name: 22 characters, [A-Za-z]
1,^[a-zA-Z]{16}$,Metasploit-style service name: 16 characters, [A-Za-z] 1,^[a-zA-Z]{16}$,Metasploit-style service name: 16 characters, [A-Za-z]