search

SigmaHQ / sigma

Main Sigma Rule Repository
Other
8.01k stars 2.14k forks source link

Based on suspicious regedit changes sigma rules #4542

Open HydraDragonAntivirus opened 9 months ago

HydraDragonAntivirus commented 9 months ago

Description of the Idea of the Rule

Suspicious reg changes

Public References / Exampel Event Log

https://github.com/HydraDragonAntivirus/OpenSourceViruses/blob/main/suspiciousregchangesandtaskkils

github-actions[bot] commented 9 months ago

Welcome @HydraDragonAntivirus :wave:

It looks like this is your first issue on the Sigma rules repository!

The following repository accepts issues related to false positives or 'rule ideas'.

If you're reporting an issue related to the pySigma library please consider submitting it here

If you're reporting an issue related to the deprecated sigmac library please consider submitting it here

Thanks for taking the time to open this issue, and welcome to the Sigma community! :smiley:

nasbench commented 9 months ago

Hey @HydraDragonAntivirus thanks for taking the time to propose this. Will look into the link you posted and report back :)

Cheers.

HydraDragonAntivirus commented 9 months ago

Also you can use my virus website and ips database to check is this file trying to connect malicious file by sigma rule.