Sigma Rule Update (2023-12-22 20:07:32) (#559)

Co-authored-by: hach1yon <[email protected]>
Yamato-Security · Dec 22, 2023 · 0b2f00d · 0b2f00d
1 parent 868624f
commit 0b2f00d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/sigma/builtin/process_creation/proc_creation_win_reg_nolmhash.yml b/sigma/builtin/process_creation/proc_creation_win_reg_nolmhash.yml
@@ -17,6 +17,7 @@ references:
     - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023/12/15
+modified: 2023/12/22
 tags:
     - attack.defense_evasion
     - attack.t1112
@@ -29,7 +30,7 @@ detection:
         Channel: Security
     selection:
         CommandLine|contains|all:
-            - \System\CurrentControlSet\Control\Lsa\
+            - \System\CurrentControlSet\Control\Lsa
             - NoLMHash
             - ' 0'
     condition: process_creation and selection

diff --git a/sigma/sysmon/process_creation/proc_creation_win_reg_nolmhash.yml b/sigma/sysmon/process_creation/proc_creation_win_reg_nolmhash.yml
@@ -17,6 +17,7 @@ references:
     - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023/12/15
+modified: 2023/12/22
 tags:
     - attack.defense_evasion
     - attack.t1112
@@ -30,7 +31,7 @@ detection:
         Channel: Microsoft-Windows-Sysmon/Operational
     selection:
         CommandLine|contains|all:
-            - \System\CurrentControlSet\Control\Lsa\
+            - \System\CurrentControlSet\Control\Lsa
             - NoLMHash
             - ' 0'
     condition: process_creation and selection