CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-07 17:52:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sigma Rule Update (2025-06-26 20:15:18) (#83)

Browse Source 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
2025-06-26 20:15:25 +00:00
committed by GitHub
parent 7537634077
commit c0f39c2ef0
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
config/security_rules.json
View File

@@ -15002,6 +15002,23 @@
],
"title": "Suspicious Curl.EXE Download"
},
{
"category": "process_creation",
"channel": [
"sec"
],
"description": "Detects the execution of PowerShell commands that attempt to install MSI packages via the\nWindows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\nThis could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\nAnd the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\n",
"event_ids": [
"4688"
],
"id": "67cbe37e-314f-cce4-2882-0cb45993a3c5",
"level": "medium",
"service": "",
"subcategory_guids": [
"0CCE922B-69AE-11D9-BED3-505054503030"
],
"title": "PowerShell MSI Install via WindowsInstaller COM From Remote Location"
},
{
"category": "process_creation",
"channel": [