Sigma Rule Update (2024-11-14 20:15:22) (#772)

Co-authored-by: hach1yon <[email protected]>
Yamato-Security · Nov 14, 2024 · 02ed1ff · 02ed1ff
1 parent 375de85
commit 02ed1ff
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/sigma/builtin/process_creation/proc_creation_win_susp_system_user_anomaly.yml b/sigma/builtin/process_creation/proc_creation_win_susp_system_user_anomaly.yml
@@ -10,7 +10,7 @@ references:
     - https://tools.thehacker.recipes/mimikatz/modules
 author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
 date: 2021-12-20
-modified: 2024-07-22
+modified: 2024-11-11
 tags:
     - attack.credential-access
     - attack.defense-evasion
@@ -80,7 +80,10 @@ detection:
               - MiniDump    # Process dumping method apart from procdump
               - 'net user '
     filter_main_ping:
-        CommandLine|contains: ping 127.0.0.1 -n
+        CommandLine|contains|all:
+            - ping
+            - 127.0.0.1
+            - ' -n '
     filter_vs:
         ParentCommandLine|contains: \DismFoDInstall.cmd
         NewProcessName|endswith: \PING.EXE

diff --git a/sigma/sysmon/process_creation/proc_creation_win_susp_system_user_anomaly.yml b/sigma/sysmon/process_creation/proc_creation_win_susp_system_user_anomaly.yml
@@ -10,7 +10,7 @@ references:
     - https://tools.thehacker.recipes/mimikatz/modules
 author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
 date: 2021-12-20
-modified: 2024-07-22
+modified: 2024-11-11
 tags:
     - attack.credential-access
     - attack.defense-evasion
@@ -81,7 +81,10 @@ detection:
               - MiniDump    # Process dumping method apart from procdump
               - 'net user '
     filter_main_ping:
-        CommandLine|contains: ping 127.0.0.1 -n
+        CommandLine|contains|all:
+            - ping
+            - 127.0.0.1
+            - ' -n '
     filter_vs:
         Image|endswith: \PING.EXE
         ParentCommandLine|contains: \DismFoDInstall.cmd