Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-10 18:01:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cleaned up signature descriptions and metadata.

Browse Source
This commit is contained in:
keyboardcrunch
2020-12-05 21:45:38 -06:00
parent 08e20670ee
commit 4d6ac236bc
59 changed files with 284 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/windows/deobfuscate_or_decode_files.yml
+6 -8
View File
@@ -1,19 +1,17 @@
title: Deobfuscate or Decode Files
description: This Atomic tests detections of certutil encoding and decoding of executables,
and the replication of certutil for bypassing detection of executable encoding.
Our query below will detected renamed certutil through matching of DisplayName,
as well as encoding or decoding of exe files.
description: Detect certutil encoding and decoding of executables,
or use of renamed certutil.exe for bypassing detections.
author: keyboardcrunch
date: 10/10/2020
modified: null
modified: 05/12/2020
mitre:
tactic: Defense Evasion
technique: T1140
subtechnique: null
subtechnique:
operating_system: windows
query: (TgtProcName != "certutil.exe" AND TgtProcDisplayName = "CertUtil.exe") OR
( TgtProcDisplayName = "CertUtil.exe" AND (TgtProcCmdLine RegExp "^.*(-decode).*\.(exe)"
OR TgtProcCmdLine RegExp "^.*(-encode).*\.(exe)") )
false_positives: null
tags: null
false_positives:
tags: