Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update WannaCry Ransomware Activity #5131

Open
nasbench opened this issue Dec 16, 2024 · 0 comments
Open

Update WannaCry Ransomware Activity #5131

nasbench opened this issue Dec 16, 2024 · 0 comments
Assignees
Labels
Create Pull-Request issues that should be provided as a pull request

Comments

@nasbench
Copy link
Member

Update https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml to remove the following section

- CommandLine|contains|all:
              - 'icacls'
              - '/grant'
              - 'Everyone:F'
              - '/T'
              - '/C'
              - '/Q'
        - CommandLine|contains|all:
              - 'bcdedit'
              - '/set'
              - '{default}'
              - 'recoveryenabled'
              - 'no'
        - CommandLine|contains|all:
              - 'wbadmin'
              - 'delete'
              - 'catalog'
              - '-quiet'

This section isn't specific to WannaCry and we already have generic coverage for it. See https://x.com/nas_bench/status/1868639048484425963

@nasbench nasbench added the Create Pull-Request issues that should be provided as a pull request label Dec 16, 2024
@nasbench nasbench self-assigned this Dec 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Create Pull-Request issues that should be provided as a pull request
Projects
None yet
Development

No branches or pull requests

1 participant