Closed Shraknard closed 1 week ago
I got an other detection from Windows Defender.
This time from rule : Aurora-Agent\signatures\sigma-rules\public\windows\powershell\powershell_classic\posh_pc_tamper_windows_defender_set_mp.yml
.
It was considered as trojan Trojan:Win32/BatTamper.A
. Severity : high
Hi, I'm facing the same issue, the 2 "trojans" are quarantined by Defender consistently. Have you found any explanation ?
Please read the explanation I gave here https://github.com/SigmaHQ/sigma/issues/4925
Hi, just got a high detection from WIndows Defender on one of the Aurora yml rule :
posh_pc_tamper_windows_defender_set_mp.yml
.It was detected as
Trojan:Script/Phonzy.A!ml
and quarantined.Affected elements are :
Aurora-Agent\signatures\sigma-rules\public\windows\powershell\powershell_classic\posh_pc_tamper_windows_defender_set_mp.yml
Aurora-Agent\signatures\sigma-rules\public\windows\powershell\powershell_script\posh_ps_tamper_windows_defender_set_mp.yml
Not sure what part of the file could have triggered it but it seems to be a ML detection so maybe it just misunderstood.
Also, Aurora light is installed for like a week, so I'm not sure why it didn't trigger before.
Content of the file :
Not sure if this is considered as a real issue but at least you have the info now.