Merge PR SigmaHQ#4644 from @qasimqlf - Add Missing CommandLine Field …

…Selection fix: Suspicious Redirection to Local Admin Share - Add missing CommandLine field selection --------- Co-authored-by: frack113 <[email protected]>
resp404nse · Dec 28, 2023 · 17b87ec · 17b87ec
1 parent e0cf5f3
commit 17b87ec
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml b/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml
@@ -7,7 +7,7 @@ references:
     - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
 author: Florian Roth (Nextron Systems)
 date: 2022/01/16
-modified: 2022/09/09
+modified: 2023/12/28
 tags:
     - attack.exfiltration
     - attack.t1048
@@ -18,8 +18,9 @@ detection:
     selection_redirect:
         CommandLine|contains: '>'
     selection_share:
-        - '\\\\127.0.0.1\\admin$\\'
-        - '\\\\localhost\\admin$\\'
+        CommandLine|contains:
+            - '\\\\127.0.0.1\\admin$\\'
+            - '\\\\localhost\\admin$\\'
     condition: all of selection_*
 falsepositives:
     - Unknown