Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-11 02:11:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cleaned up signature descriptions and metadata.

Browse Source
This commit is contained in:
keyboardcrunch
2020-12-05 21:45:38 -06:00
parent 08e20670ee
commit 4d6ac236bc
59 changed files with 284 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/windows/non_windows_control_panel_item.yml
+6 -6
View File
@@ -1,10 +1,9 @@
title: Non-Windows Control Panel Item
description: The below query will find all cpl files outside standard directories
and all cpl files executed outside of Windows directories. First portion of query
may need to be dropped if there's too much noise in your environment.
description: Detect cpl files outside standard Windows directories. First portion
of query may need to be dropped if there is too much noise in your environment.
author: keyboardcrunch
date: 10/10/2020
modified: null
modified: 05/12/2020
mitre:
tactic: Defense Evasion
technique: T1218
@@ -14,6 +13,7 @@ query: (TgtFileExtension = "cpl" AND TgtFilePath Does Not ContainCIS "C:\Windows
AND TgtFilePath Does Not ContainCIS "C:\Program Files" AND TgtFilePath Does Not
ContainCIS "C:\$WINDOWS.~BT") OR (SrcProcName = "control.exe" AND SrcProcCmdLine
ContainsCIS ".cpl" AND SrcProcCmdLine Does Not ContainCIS "C:\Windows")
false_positives: null
tags: null
false_positives:
- Applications bringing their own cpl files
tags: