Yamato Security
d668fc9241
* update rule config files and art * regexサンプルファイルの名前変更 * fixed test error due to filename change #291 Co-authored-by: DustInDark <nextsasasa@gmail.com>
17 lines
462 B
Plaintext
17 lines
462 B
Plaintext
^cmd.exe /c echo [a-z]{6} > \\\\.\\pipe\\[a-z]{6}$
|
|
^%SYSTEMROOT%\\[a-zA-Z]{8}\.exe$
|
|
powershell.*FromBase64String.*IO.Compression.GzipStream
|
|
DownloadString\(.http
|
|
mimikatz
|
|
Invoke-Mimikatz.ps
|
|
PowerSploit.*ps1
|
|
User-Agent
|
|
[a-zA-Z0-9/+=]{500}
|
|
powershell.exe.*Hidden.*Enc
|
|
\\csc\.exe
|
|
\\csc\.exe.*\\Appdata\\Local\\Temp\\[a-z0-9]{8}\.cmdline
|
|
# Generic cvtres.exe alert
|
|
\\cvtres\.exe.*
|
|
\\cvtres\.exe.*\\AppData\\Local\\Temp\\[A-Z0-9]{7}\.tmp
|
|
^[a-zA-Z]{22}$
|
|
^[a-zA-Z]{16}$ |