rule: emotet encoded commands

lukiffer · Oct 20, 2020 · 198b292 · 198b292
1 parent 986b711
commit 198b292
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml b/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
@@ -6,7 +6,7 @@ references:
     - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
 author: Florian Roth, Markus Neis
 date: 2018/09/03
-modified: 2019/12/16
+modified: 2020/10/20
 tags:
     - attack.execution
     - attack.t1059.001
@@ -36,6 +36,10 @@ detection:
             - '* -enc aWV4I*'
             - '* -enc SQBFAFgA*'
             - '* -enc aQBlAHgA*'
+            - '* -e* IAA*'
+            - '* -e* IAB*'
+            - '* -e* UwB*'
+            - '* -e* cwB*'
     falsepositive1:
         CommandLine: '* -ExecutionPolicy remotesigned *'
     condition: selection and not falsepositive1