Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-11 02:11:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

auto-generated queries from markdown notes

Browse Source
This commit is contained in:
@
2020-11-23 12:08:31 -06:00
parent a3c07c2199
commit 7c09d914d1
85 changed files with 1414 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/windows/browser_extension_installation.yml
+17
View File
@@ -0,0 +1,17 @@
title: Browser Extension Installation
description: This query takes a lazy approach to detecting the staging of xpi or crx
extension packages for installation within Chrome and Firefox based browsers. Unsure
how to filter our extension updates without excluding too much.
author: keyboardcrunch
date: 10/10/2020
modified: null
mitre:
tactic: Persistence
technique: T1176
subtechnique: null
operating_system: windows
query: ( FileFullName RegExp "\bWebstore Downloads\b.*\.(crx)$" OR FileFullName RegExp
"\bstaged\b.*\.(xpi)$" ) AND EventType = "File Creation"
false_positives: null
tags: null