Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MS Office Doc Load WMI DLL Rule #583

Merged
merged 3 commits into from
Dec 30, 2019
Merged

MS Office Doc Load WMI DLL Rule #583

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
845d67f
Initial Upload
mrippey Dec 29, 2019
a45f877
Update win_susp_winword_wmidll_load.yml
mrippey Dec 30, 2019
dbdf668
Update win_susp_winword_wmidll_load.yml
mrippey Dec 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Update win_susp_winword_wmidll_load.yml 
Update x2
  • Loading branch information
@mrippey
mrippey authored Dec 30, 2019
commit dbdf6680e0320ee1e0f36276b3900e897c4418a4
4 changes: 2 additions & 2 deletions rules/windows/sysmon/win_susp_winword_wmidll_load.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@

title: Suspicious Windows Mangement Instrumentation DLL Loaded Via Microsoft Word
id: a457f232-7df9-491d-898f-b5aabd2cbe2f
status: experimental
description: Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands
references:
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
- https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/
- https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT-EU-SA2019-021.pdf
author: Michael R. @nahamike01
author: Michael R. (@nahamike01)
date: 2019/12/26
tags:
- attack.execution
Expand Down