Updated rules

2021-11-06 09:51:38 +09:00
parent cb5bf450bb
commit f29b7d2d1a
32 changed files with 176 additions and 114 deletions
@@ -0,0 +1,15 @@
+title: Command Line Logging
+description: hogehoge
+ignore: true
+author: DeepblueCLI, Zach Mathis
+detection:
+    selection:
+        Channel: Security
+        EventID: 4672
+        PrivilegeList|contains: SeDebugPrivilege
+    # condition: selection
+falsepositives:
+    - unknown
+output: 'CommandLine:%CommandLine% ParentProcessName:%ParentProcessName%'
+creation_date: 2020/11/8
+updated_date: 2020/11/8