New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add sysmon_win_reg_persistence_recycle_bin.yml #2279

Merged

frack113 merged 1 commit into SigmaHQ:master from frack113:malware

Nov 19, 2021

$frack113$

Member

$@frack113$ frack113 commented Nov 18, 2021

Very funny
Test in a VM by hand
sysmon 13.30

<TargetObject name="T1547" condition="end with">CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command</TargetObject>

$@frack113$


Add sysmon_win_reg_persistence_recycle_bin.yml

8176d9b

$@frack113$ frack113 added the Rules label

$@frack113$ frack113 merged commit 13099ea into SigmaHQ:master

$@frack113$ frack113 deleted the malware branch

November 19, 2021 18:11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment